Author Topic: malware aurora, trojans, etc (Read 6568 times)

physicsforfun · « **on:** August 28, 2005, 08:03:33 PM »

This computer has been suffering more and more from various malware that I cant seem to get out...I have installed and am running the Microsoft Anti Spyware beta 1 but the "real-time protection" seems to get turned off all the time and whatever is removed seems to come right back..There is also a 2 year old ZoneAlarm Pro running as well as the symantec antivirus corporate edition. Anyway, after running the MS spyware scan and removing all recommended iteoms, I rebooted and rand Hijackthis 1.99.1. I am running another spyware scan right now to see what shows up:

trojan.agent.fgdxbi
transponder.abetterinternet.aurora
newdotnet
searchmiracle.elitebar

the HijackThis logfile is below. Please help> Thanks
Paul

Logfile of HijackThis v1.99.1
Scan saved at 8:01:39 PM, on 8/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\moztebz.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\QuickTime\qttask.exe
C:\DOCUME~1\Paul\LOCALS~1\Temp\QGK\aurareco.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WinFixer 2005\wfx5.exe
C:\Program Files\snss\snss.exe
C:\WINDOWS\mm15201518.a.Stub.exe
C:\WINDOWS\system32\cdfview6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\Program Files\Common Files\WinSoftware\WFF.exe
C:\Documents and Settings\Paul\Desktop\software stuff\HijackThis adaware etc\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\system32\Searchx.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [wpzexe] c:\windows\system32\wpzexe.exe
O4 - HKLM\..\Run: [WinFixer 2005] C:\Program Files\WinFixer 2005\wfx5.exe /min
O4 - HKLM\..\Run: [snss Launcher] "C:\Program Files\snss\snss.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\lsddsl.exe reg_run
O4 - HKLM\..\Run: [immin] C:\WINDOWS\mm15201518.a.Stub.exe
O4 - HKLM\..\Run: [610eb4e05f5b] C:\WINDOWS\system32\cdfview6.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKLM\..\Run: [vvgmvp] C:\WINDOWS\system32\moztebz.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab
O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\fwsperf.dll
O21 - SSODL: Getwiz - {0FECF7A8-BE81-4D80-A201-036FACABE079} - C:\WINDOWS\system32\diskbot.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

guestolo · « **Reply #1 on:** August 28, 2005, 08:23:58 PM »

Quote

I am running another spyware scan right now to see what shows up

Can you let me know which one you run

Also restart your computer after running the above scan and then post a fresh hijackthis log
Don't run any other scanners after I see your new log

I want to see everything before it is fixed or altered

physicsforfun · « **Reply #2 on:** August 29, 2005, 09:19:11 PM »

The items that I previously listed were the ones that appeared in the Microsoft spyware (beta 1) scan.

trojan.agent.fgdxbi
transponder.abetterinternet.aurora
newdotnet
searchmiracle.elitebar

I then used the program to "remove" them but it does not work.

I was and am using the Microsoft Antispyware (Beta 1) program to find and remove spyware, but it is not working very well. The real-time protection keeps getting truned off and the items that are "removed" seem to reappear upon boot up.

The computer also suffers from the symptom that often it seems impossible to log off or shut down normally, so we must power it off and reboot to get logged off.

Now I will post the Hijack This logfile that I got when I first rebooted this evening and ran HijackTHis. Then I will run a again the Microsoft Antispyware beta 1. I will list below the first Hijackthis logfile the items that appeared and were "removed" by the Microsoft antiSpyware Beta 1 program. Following that "removal" process and the mandatory reboot, I will post a final HijackThis logfile and wait for your diagnosis.

Logfile of HijackThis v1.99.1
Scan saved at 9:40:08 PM, on 8/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\asqvjq.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WinFixer 2005\wfx5.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\snss\snss.exe
C:\DOCUME~1\Paul\LOCALS~1\Temp\MOW\aurareco.exe
C:\WINDOWS\mm15201518.a.Stub.exe
C:\WINDOWS\system32\cdfview6.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\DOCUME~1\Paul\LOCALS~1\Temp\dinst.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
C:\Program Files\Common Files\WinSoftware\WFF.exe
C:\Documents and Settings\Paul\Desktop\software stuff\HijackThis adaware etc\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\system32\Searchx.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [wpzexe] c:\windows\system32\wpzexe.exe
O4 - HKLM\..\Run: [WinFixer 2005] C:\Program Files\WinFixer 2005\wfx5.exe /min
O4 - HKLM\..\Run: [snss Launcher] "C:\Program Files\snss\snss.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\lsddsl.exe reg_run
O4 - HKLM\..\Run: [immin] C:\WINDOWS\mm15201518.a.Stub.exe
O4 - HKLM\..\Run: [610eb4e05f5b] C:\WINDOWS\system32\cdfview6.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [cpzvxs] C:\WINDOWS\system32\asqvjq.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab
O20 - Winlogon Notify: Run - C:\WINDOWS\system32\fwsperf.dll
O21 - SSODL: Getwiz - {0FECF7A8-BE81-4D80-A201-036FACABE079} - C:\WINDOWS\system32\diskbot.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

Here is what Microsoft Antispyware Beta 1 found and "removed"

transponder.grandstreet
alwaysupdatenews
trojan.agent.fgdxbi
transponder.abetterinternet.aurora (shows up twice)
newdotnet
searchmiracle.elitebar

Here is the final HijackThis logfile:

Logfile of HijackThis v1.99.1
Scan saved at 10:10:29 PM, on 8/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\system32\dmgkhi.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\DOCUME~1\Paul\LOCALS~1\Temp\LXF\aurareco.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WinFixer 2005\wfx5.exe
C:\Program Files\snss\snss.exe
C:\WINDOWS\mm15201518.a.Stub.exe
C:\WINDOWS\system32\cdfview6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\DOCUME~1\Paul\LOCALS~1\Temp\dinst.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\WinSoftware\WFF.exe
C:\Documents and Settings\Paul\Desktop\software stuff\HijackThis adaware etc\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\system32\Searchx.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [wpzexe] c:\windows\system32\wpzexe.exe
O4 - HKLM\..\Run: [WinFixer 2005] C:\Program Files\WinFixer 2005\wfx5.exe /min
O4 - HKLM\..\Run: [snss Launcher] "C:\Program Files\snss\snss.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\lsddsl.exe reg_run
O4 - HKLM\..\Run: [immin] C:\WINDOWS\mm15201518.a.Stub.exe
O4 - HKLM\..\Run: [610eb4e05f5b] C:\WINDOWS\system32\cdfview6.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKLM\..\Run: [aoeqjll] C:\WINDOWS\system32\dmgkhi.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab
O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\fwsperf.dll
O21 - SSODL: Getwiz - {0FECF7A8-BE81-4D80-A201-036FACABE079} - C:\WINDOWS\system32\diskbot.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

I would appreciate any suggestions you might offer at this time...

Paul

guestolo · « **Reply #3 on:** August 29, 2005, 09:21:49 PM »

Great, thanx for the info

Download L2mfix from here

http://www.atribune.org/downloads/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

[color=\"red\"]IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so![/color]

physicsforfun · « **Reply #4 on:** August 29, 2005, 09:39:43 PM »

I did as you said and the L2MFIx tool by shadowwar v1.04a is up and trying to run . I typed 1 enter at the proper promt. However, I have a panel up with the title:

16 bit MS-DOS Subsystem

C:\windows\system32\cmd.exe
C:\windows\system32autoexec.nt. the system file is not suitable for running ms-dos and microsoft applications. choose "close" to terminate the application.

Close and ignore are my two choices...

which is it the lady or the tiger?

guestolo · « **Reply #5 on:** August 29, 2005, 09:56:30 PM »

Please follow this link
http://www.tech-forums.net/computer/topic/29806.html

Download and install the fix for your operating system
If your unsure if your using XP Pro or Home
Go to start>>run>>type in "winver" without quotes and hit OK

Afterwards restart your computer and try the above instructions again

physicsforfun · « **Reply #6 on:** August 29, 2005, 10:10:36 PM »

Here is the report.txt from the run of l2mfix.bat

L2MFIX find log 1.04a
These are the registry keys present
********************************************************************************
**
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DateTime]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\fwsperf.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access    NT AUTHORITY\SYSTEM
(IO) ALLOW Full access    NT AUTHORITY\SYSTEM
(NI) ALLOW Full access    NT AUTHORITY\SYSTEM
(IO) ALLOW Full access    NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read     BUILTIN\Users
(ID-IO) ALLOW Read     BUILTIN\Users
(ID-NI) ALLOW Full access    BUILTIN\Administrators
(ID-IO) ALLOW Full access    BUILTIN\Administrators
(ID-NI) ALLOW Full access    NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access    NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access    CREATOR OWNER

********************************************************************************
**
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{9C5EDD24-749D-D1EC-AC4E-270872BC8E01}"=""
"acc=marketingsector"=" "

********************************************************************************
**
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt"
"{5CA3D70E-1895-11CF-8E15-001234567890}"="DriveLetterAccess"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{C56C4E21-706D-11d0-AFC5-444553540002}"="My Digital Camera"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{950FF917-7A57-46BC-8017-59D9BF474000}"="Shell Extension for CDRW"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}"=""
"{C08C8B60-9972-4CE2-8F9D-875AF530C452}"=""
"{B4B78A94-EB3B-4295-9E81-52220B138161}"=""
"{DB9E2D35-7F63-4B66-8739-11D0037865E4}"=""

********************************************************************************
**
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}\InprocServer32]
@="C:\\WINDOWS\\system32\\MJCUIA32.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C08C8B60-9972-4CE2-8F9D-875AF530C452}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C08C8B60-9972-4CE2-8F9D-875AF530C452}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C08C8B60-9972-4CE2-8F9D-875AF530C452}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C08C8B60-9972-4CE2-8F9D-875AF530C452}\InprocServer32]
@="C:\\WINDOWS\\system32\\fqsperf.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B4B78A94-EB3B-4295-9E81-52220B138161}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B4B78A94-EB3B-4295-9E81-52220B138161}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B4B78A94-EB3B-4295-9E81-52220B138161}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B4B78A94-EB3B-4295-9E81-52220B138161}\InprocServer32]
@="C:\\WINDOWS\\system32\\SXNYHCY.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DB9E2D35-7F63-4B66-8739-11D0037865E4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DB9E2D35-7F63-4B66-8739-11D0037865E4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DB9E2D35-7F63-4B66-8739-11D0037865E4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DB9E2D35-7F63-4B66-8739-11D0037865E4}\InprocServer32]
@="C:\\WINDOWS\\system32\\MZVCP70.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}\InprocServer32]
@="C:\\WINDOWS\\system32\\MJCUIA32.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C08C8B60-9972-4CE2-8F9D-875AF530C452}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C08C8B60-9972-4CE2-8F9D-875AF530C452}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C08C8B60-9972-4CE2-8F9D-875AF530C452}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C08C8B60-9972-4CE2-8F9D-875AF530C452}\InprocServer32]
@="C:\\WINDOWS\\system32\\fqsperf.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B4B78A94-EB3B-4295-9E81-52220B138161}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B4B78A94-EB3B-4295-9E81-52220B138161}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B4B78A94-EB3B-4295-9E81-52220B138161}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B4B78A94-EB3B-4295-9E81-52220B138161}\InprocServer32]
@="C:\\WINDOWS\\system32\\SXNYHCY.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DB9E2D35-7F63-4B66-8739-11D0037865E4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DB9E2D35-7F63-4B66-8739-11D0037865E4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DB9E2D35-7F63-4B66-8739-11D0037865E4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DB9E2D35-7F63-4B66-8739-11D0037865E4}\InprocServer32]
@="C:\\WINDOWS\\system32\\MZVCP70.DLL"
"ThreadingModel"="Apartment"

********************************************************************************
**
Files Found are not all bad files:

guestolo · « **Reply #7 on:** August 29, 2005, 10:21:14 PM »

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #4 by typing 4 and then pressing Enter

Then select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

[color=\"red\"]IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so![/color]

NOTE:After restart and L2MFIX finishes scanning for files>>give this time to finish
If a text doesn't open, run the "second.bat" located inside the L2mfix folder

physicsforfun · « **Reply #8 on:** August 29, 2005, 10:46:42 PM »

here is the lm2fix log file

Setting Directory
C:\
C:\
System Rebooted!

Running From:
C:\

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1820 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1844 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\aqferror.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\aqferror.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fqsperf.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fqsperf.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fwsperf.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fwsperf.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MJCUIA32.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MJCUIA32.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MZVCP70.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MZVCP70.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\xusp1res.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\xusp1res.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\aqferror.dll
Successfully Deleted: C:\WINDOWS\system32\aqferror.dll
deleting: C:\WINDOWS\system32\aqferror.dll
Successfully Deleted: C:\WINDOWS\system32\aqferror.dll
deleting: C:\WINDOWS\system32\fqsperf.dll
Successfully Deleted: C:\WINDOWS\system32\fqsperf.dll
deleting: C:\WINDOWS\system32\fqsperf.dll
Successfully Deleted: C:\WINDOWS\system32\fqsperf.dll
deleting: C:\WINDOWS\system32\fwsperf.dll
Successfully Deleted: C:\WINDOWS\system32\fwsperf.dll
deleting: C:\WINDOWS\system32\fwsperf.dll
Successfully Deleted: C:\WINDOWS\system32\fwsperf.dll
deleting: C:\WINDOWS\system32\MJCUIA32.DLL
Successfully Deleted: C:\WINDOWS\system32\MJCUIA32.DLL
deleting: C:\WINDOWS\system32\MJCUIA32.DLL
Successfully Deleted: C:\WINDOWS\system32\MJCUIA32.DLL
deleting: C:\WINDOWS\system32\MZVCP70.DLL
Successfully Deleted: C:\WINDOWS\system32\MZVCP70.DLL
deleting: C:\WINDOWS\system32\MZVCP70.DLL
Successfully Deleted: C:\WINDOWS\system32\MZVCP70.DLL
deleting: C:\WINDOWS\system32\xusp1res.dll
Successfully Deleted: C:\WINDOWS\system32\xusp1res.dll
deleting: C:\WINDOWS\system32\xusp1res.dll
Successfully Deleted: C:\WINDOWS\system32\xusp1res.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

Zipping up files for submission:
adding: aqferror.dll (208 bytes security) (deflated 48%)
adding: fqsperf.dll (208 bytes security) (deflated 48%)
adding: fwsperf.dll (208 bytes security) (deflated 48%)
adding: MJCUIA32.DLL (208 bytes security) (deflated 48%)
adding: MZVCP70.DLL (208 bytes security) (deflated 48%)
adding: xusp1res.dll (208 bytes security) (deflated 48%)
adding: guard.tmp (208 bytes security) (deflated 48%)
adding: clear.reg (208 bytes security) (deflated 52%)
adding: lo2.txt (208 bytes security) (deflated 84%)
adding: test.txt (208 bytes security) (deflated 83%)
adding: test2.txt (208 bytes security) (deflated 33%)
adding: test3.txt (208 bytes security) (deflated 33%)
adding: test5.txt (208 bytes security) (deflated 33%)
adding: xfind.txt (208 bytes security) (deflated 79%)

Restoring Registry Permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!

Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access    NT AUTHORITY\SYSTEM
(IO) ALLOW Full access    NT AUTHORITY\SYSTEM
(NI) ALLOW Full access    NT AUTHORITY\SYSTEM
(IO) ALLOW Full access    NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read     BUILTIN\Users
(ID-IO) ALLOW Read     BUILTIN\Users
(ID-NI) ALLOW Full access    BUILTIN\Administrators
(ID-IO) ALLOW Full access    BUILTIN\Administrators
(ID-NI) ALLOW Full access    NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access    NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access    CREATOR OWNER

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

Restoring Windows Update Certificates.:

deleting local copy: aqferror.dll
deleting local copy: aqferror.dll
deleting local copy: fqsperf.dll
deleting local copy: fqsperf.dll
deleting local copy: fwsperf.dll
deleting local copy: fwsperf.dll
deleting local copy: MJCUIA32.DLL
deleting local copy: MJCUIA32.DLL
deleting local copy: MZVCP70.DLL
deleting local copy: MZVCP70.DLL
deleting local copy: xusp1res.dll
deleting local copy: xusp1res.dll
deleting local copy: guard.tmp
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

The following are the files found:
****************************************************************************
C:\WINDOWS\system32\aqferror.dll
C:\WINDOWS\system32\aqferror.dll
C:\WINDOWS\system32\fqsperf.dll
C:\WINDOWS\system32\fqsperf.dll
C:\WINDOWS\system32\fwsperf.dll
C:\WINDOWS\system32\fwsperf.dll
C:\WINDOWS\system32\MJCUIA32.DLL
C:\WINDOWS\system32\MJCUIA32.DLL
C:\WINDOWS\system32\MZVCP70.DLL
C:\WINDOWS\system32\MZVCP70.DLL
C:\WINDOWS\system32\xusp1res.dll
C:\WINDOWS\system32\xusp1res.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}"=-
"{C08C8B60-9972-4CE2-8F9D-875AF530C452}"=-
"{B4B78A94-EB3B-4295-9E81-52220B138161}"=-
"{DB9E2D35-7F63-4B66-8739-11D0037865E4}"=-
[-HKEY_CLASSES_ROOT\CLSID\{5DCAC5BF-0C9F-4156-A5C8-4EBDA4E93F8E}]
[-HKEY_CLASSES_ROOT\CLSID\{C08C8B60-9972-4CE2-8F9D-875AF530C452}]
[-HKEY_CLASSES_ROOT\CLSID\{B4B78A94-EB3B-4295-9E81-52220B138161}]
[-HKEY_CLASSES_ROOT\CLSID\{DB9E2D35-7F63-4B66-8739-11D0037865E4}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************

Here is the new Hijackthis logfile

Logfile of HijackThis v1.99.1
Scan saved at 11:42:37 PM, on 8/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\eetu.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\nauibr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\TEMP\MZA\aurareco.exe
C:\WINDOWS\TEMP\dinst.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Paul\Desktop\software stuff\HijackThis adaware etc\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\system32\Searchx.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [wpzexe] c:\windows\system32\wpzexe.exe
O4 - HKLM\..\Run: [WinFixer 2005] C:\Program Files\WinFixer 2005\wfx5.exe /min
O4 - HKLM\..\Run: [snss Launcher] "C:\Program Files\snss\snss.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\lsddsl.exe reg_run
O4 - HKLM\..\Run: [immin] C:\WINDOWS\mm15201518.a.Stub.exe
O4 - HKLM\..\Run: [610eb4e05f5b] C:\WINDOWS\system32\cdfview6.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKLM\..\Run: [jixdjvs] C:\WINDOWS\system32\nauibr.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: nitc.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab
O21 - SSODL: Getwiz - {0FECF7A8-BE81-4D80-A201-036FACABE079} - C:\WINDOWS\system32\diskbot.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

guestolo · « **Reply #9 on:** August 29, 2005, 11:26:05 PM »

Good work, I'm going to try an alternative to removing one of your infections with Ad-aware
It has been updated to fix this problem

So please follow all the instructions closely
Print everything out or save too a Notepad file for reference

==Download and Install this small program
to help clean your temp folders,cookies, etc...
Windows Cleanup! 4.0
Don't run it yet

==Download and save WinPFind.zip
UNZIP the contents to your desktop
Don't run it yet

Download LQfix.exe
and place it on your desktop.
Doubleclick LQfix.exe and click install.
This will create a new folder called LQfix on your desktop.
We'll need this later

==Download and then Install
Ewido Security Suite

When installing, under "Additional Options" Uncheck "Install background guard" and "Install scan via context menu".
When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We'll fix that later
From the main ewido screen, click on Update in the left menu, then click the Start update button.
After the update finishes (the status bar at the bottom will display "Update successful")
Close out Ewido for now, we'll need it later
If for some reason the Updater won't work can you manually download the
Updates from this link after you have Ewido installed
http://www.ewido.net/en/download/updates/

Make sure you have the latest version of Ad-Aware installed
Download and InstallAd-Aware SE Personal 1.06
Open Ad-Aware, ensure to click the check for updates now link and Connect to download the latest updates
After Ad-aware had been installed and updated I need you to do the following
Follow the link to download and install
VX2 Cleaner Plug-in.

After the plugin is installed please do the following

Set Windows To Show Hidden Files and Folders
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Uncheck the Hide Extensions for known file types
* Click Yes to confirm.
* Click OK.

Disconnect from the Internet completely

Go to START>>>RUN>>>type in services.msc
Hit OK
In the next window, look on the right hand side for this service
name---- System Startup Service

Double click on it--- STOP the service--If running
In the drop down menu, change the startup type to Disabled

Run Ad-Aware
Click on Add-ons in the lefthand column. Select VX2 Cleaner V2.0 and click Run Tool. Click "OK", then, if something is found, click "Clean" as in the directions given. Click "Close", and exit Ad-Aware.

Reboot your PC and run Ad-Aware again. This time, click on the Start button in Ad-Aware, select "Perform smart system scan" and click Next. Once the scan finishes, click "Next" again. Select all objects found (right click anywhere in the list of found objects and click "Select All Objects"). Click "Next" one more time, then "OK" to confirm the removal.

You will be prompted to set Ad-Aware to run on reboot, click "OK". Exit Ad-Aware and restart your PC once again.

When Ad-Aware starts up, click on "Start", then "Next". Follow the steps above if anything is found, or click "Finish", then exit Ad-Aware.

Afterwards

RESTART your Computer in SAFE MODE
You can do this by tapping the F8 key as the system is restarting, just before Windows loads, or use the link
I supplied for a more detailed explanation

Find and delete the following files or folder if found
C:\WINDOWS\svcproc.exe <-file
C:\WINDOWS\dinst.exe <-file
C:\WINDOWS\mm15201518.a.Stub.exe <-file
C:\WINDOWS\system32\moztebz.exe <-file
C:\WINDOWS\system32\lsddsl.exe <-file
C:\WINDOWS\system32\cdfview6.exe <-file
c:\windows\system32\wpzexe.exe <-file
C:\WINDOWS\system32\Searchx.htm <-file
C:\WINDOWS\system32\eetu.exe <-file
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\nitc.exe <-file

C:\Program Files\snss <-folder
C:\Program Files\WinFixer 2005 <-folder
C:\WINDOWS\etb <-folder

==Open Windows CleanUp!>>START>>programs>>Cleanup!
Click on the CleanUp button, let it finish scanning for files
DECLINE to Log off or Restart when scan is done.

==Open Ewido Security Suite
Click on the Scanner button on the left menu
Click on the Settings button on the right
Select "Scan Every File"
OK it and then click on the "Complete System Scan"
*If Ewido finds something it will prompt you with "Infected Object found"
Ensure the following are Selected
*1. Perform Action = Remove
*2. Create Encrypted Backup in Quarantine (Recommended)
*3. Perform action with all infections
Then click OK
When Ewido has finished it's scan click the "Save Report" button
Save the report to desktop
Exit Ewido

NOTE: When Ewido is running do NOT open any other Windows
Let it do it's job

Do another scan with Hijackthis and put a check next to these entries:
Not all may be present, fix what you find

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\system32\Searchx.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O4 - HKLM\..\Run: [wpzexe] c:\windows\system32\wpzexe.exe
O4 - HKLM\..\Run: [WinFixer 2005] C:\Program Files\WinFixer 2005\wfx5.exe /min
O4 - HKLM\..\Run: [snss Launcher] "C:\Program Files\snss\snss.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\lsddsl.exe reg_run
O4 - HKLM\..\Run: [immin] C:\WINDOWS\mm15201518.a.Stub.exe
O4 - HKLM\..\Run: [610eb4e05f5b] C:\WINDOWS\system32\cdfview6.exe

O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKLM\..\Run: [vvgmvp] C:\WINDOWS\system32\moztebz.exe r
O21 - SSODL: Getwiz - {0FECF7A8-BE81-4D80-A201-036FACABE079} - C:\WINDOWS\system32\diskbot.dll
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

After you have ticked the above entries, close All other open windows,
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Open the WinPFind folder you extracted to desktop
Double click on WinPFind.exe
Click START SCAN
This could take some time as it will scan your drive
Close out after

Open the LQFix folder on your desktop
Doubleclick ClickThis.bat
Follow the prompts on the screen.
Your system will reboot afterwards.
Please be patient after reboot, because there is a script running in the background.

In Normal mode
Post the results of the WindPFind.txt located in the WinPFind folder

Also post the following
Run a new scan with Hijackthis and post a fresh log
Also include the Report from Ewidos

Guest · « **Reply #10 on:** August 30, 2005, 09:01:19 AM »

I did as you said, but could not boot up in safe mode. I got the IRQL_NOT_LESS_OR_EQUAL blue screen of death. So I went ahead with the C:\WINDOWS...file deletions in normal mode. I could delete all the files I found except mm15201518.a.stub.exe. That file could not be deleted because it was running or for some other exception. SO I just went ahead and did everything else you specified.

WindPfind.txt:

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
PECompact2 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\lpt$vpn.797
qoologic 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\lpt$vpn.797
SAHAgent 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\lpt$vpn.797
UPX! 5/3/2005 11:44:44 AM 25157 C:\WINDOWS\RMAgentOutput.dll
UPX! 1/10/2005 4:17:24 PM 170053 C:\WINDOWS\tsc.exe
PECompact2 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\VPTNFILE.797
qoologic 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\VPTNFILE.797
SAHAgent 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\VPTNFILE.797
UPX! 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll
aspack 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll

Checking %System% folder...
UPX! 11/22/2002 11:21:28 AM 123904 C:\WINDOWS\SYSTEM32\avisynth.dll
UPX! 9/17/2001 2:20:02 PM 9216 C:\WINDOWS\SYSTEM32\cpuinf32.dll
69.59.186.63 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
209.66.67.134 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
66.63.167.97 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
66.63.167.77 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
web-nex 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
winsync 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
rec2_run 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
PEC2 8/29/2002 7:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
UPX! 11/24/2001 3:31:48 PM 65536 C:\WINDOWS\SYSTEM32\DVDAudio.ax
UPX! 11/24/2001 3:28:14 PM 86528 C:\WINDOWS\SYSTEM32\DVDVideo.ax
UPX! 2/20/2004 6:49:02 PM 77312 C:\WINDOWS\SYSTEM32\Ia1cm.dll
PTech 7/12/2005 5:50:44 PM 520456 C:\WINDOWS\SYSTEM32\LegitCheckControl.DLL
PECompact2 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2004 3:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 8/4/2004 3:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 8/29/2002 7:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\WBDBASE.DEU
UPX! 8/30/2005 2:05:42 AM 82432 C:\WINDOWS\SYSTEM32\__delete_on_reboot__eetu.exe

Checking %System%\Drivers folder and sub-folders...
PTech 8/4/2004 1:41:38 AM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\ETC\hosts

Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
8/30/2005 2:05:12 AM S 2048 C:\WINDOWS\BOOTSTAT.DAT
7/27/2005 9:43:58 AM H 10820 C:\WINDOWS\Help\update.GID
8/29/2005 11:35:06 PM H 335 C:\WINDOWS\SYSTEM32\vsconfig.xml
7/8/2005 4:23:18 PM S 12143 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB893756.cat
7/19/2005 7:18:10 PM S 18913 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896727.cat
7/2/2005 4:18:16 AM S 9445 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB903235.cat
8/30/2005 3:01:16 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
8/30/2005 2:05:38 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
8/30/2005 2:15:22 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
8/30/2005 3:23:28 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
8/30/2005 3:02:34 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
8/11/2005 3:01:34 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\NTUSER.DAT.LOG
8/30/2005 2:05:44 AM HS 192 C:\WINDOWS\Tasks\RUTASK.job
8/30/2005 2:05:16 AM H 6 C:\WINDOWS\Tasks\SA.DAT
8/19/2005 12:43:54 PM HS 113 C:\WINDOWS\Temp\History\History.IE5\desktop.ini
8/19/2005 12:43:54 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\1T8AO7D3\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\8DQ78PUJ\desktop.ini
8/19/2005 5:10:16 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\8XUVGXIJ\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\DQF1XA02\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\FACFJXWH\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KL0ZK34V\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KP6ZWT2J\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KPQZ4PAR\desktop.ini
8/19/2005 5:10:18 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\OHERKTYF\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\QL0BML25\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\UMB9DBLF\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\UPD2RMD8\desktop.ini

Checking for CPL files...
Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Broadcom Corporation 5/8/2003 9:25:18 PM 815104 C:\WINDOWS\SYSTEM32\B57exp.cpl
Broadcom Corporation 6/3/2003 12:38:44 PM 94208 C:\WINDOWS\SYSTEM32\BCMSM.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
FotoNation inc. 3/26/1998 2:01:34 PM 27136 C:\WINDOWS\SYSTEM32\camcpl.cpl
8/23/2005 7:49:04 PM 31232 C:\WINDOWS\SYSTEM32\conres.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Intel Corporation 4/7/2003 2:14:30 AM 94208 C:\WINDOWS\SYSTEM32\igfxcpl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems 12/28/2003 6:43:24 PM 53352 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 8/29/2002 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\MAIN.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Kristal Studio 3/2/2001 10:39:28 PM 121856 C:\WINDOWS\SYSTEM32\Mp3cnfg.cpl
Microsoft Corporation 8/29/2002 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\NCPA.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
Apple Computer, Inc. 4/8/2004 2:12:42 PM 323072 C:\WINDOWS\SYSTEM32\QuickTime.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 8/29/2002 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\TELEPHON.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\DLLCACHE\wuaucpl.cpl
Intel Corporation 4/7/2003 2:14:30 AM 94208 C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxcpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
1/20/2004 10:18:02 PM 950 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
9/3/2002 11:00:00 AM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI
1/20/2004 9:00:52 PM 1770 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
5/23/2004 6:15:04 PM 1798 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microtek Scanner Finder.lnk
1/20/2004 9:51:36 PM 782 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ZoneAlarm Pro.lnk

Checking files in %ALLUSERSPROFILE%\Application Data folder...
9/3/2002 10:50:46 AM HS 62 C:\Documents and Settings\All Users\Application Data\DESKTOP.INI

Checking files in %USERPROFILE%\Startup folder...
9/3/2002 11:00:00 AM HS 84 C:\Documents and Settings\Paul\Start Menu\Programs\Startup\DESKTOP.INI

Checking files in %USERPROFILE%\Application Data folder...
9/3/2002 10:50:46 AM HS 62 C:\Documents and Settings\Paul\Application Data\DESKTOP.INI
11/19/2004 11:41:36 AM 61408 C:\Documents and Settings\Paul\Application Data\GDIPFONTCACHEV1.DAT

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
   SV1    =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\fxqkmfgg
   {a10b8124-d9fb-4b39-a065-1ada59a38197}    = C:\WINDOWS\system32\jabke.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\LDVPMenu
   {BDA77241-42F6-11d0-85E2-00AA001FE28C}    = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
   {750fdf0e-2a26-11d1-a3ea-080036587f03}    = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
   {09799AFB-AD67-11d1-ABCD-00C04FC30936}    = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
   {A470F8CF-A1E8-4f65-8335-227475AA5C46}    = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
   Start Menu Pin    = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\LDVPMenu
   {BDA77241-42F6-11d0-85E2-00AA001FE28C}    = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
   {A470F8CF-A1E8-4f65-8335-227475AA5C46}    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
   {750fdf0e-2a26-11d1-a3ea-080036587f03}    = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
   {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}    = ntshrui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
    = %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
   &Tip of the Day = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
   Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
   MenuText    = Sun Java Console   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45}
   ButtonText    = AIM   : C:\Program Files\AIM\aim.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
   ButtonText    = PartyPoker.com   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
   ButtonText    = Real.com   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E023F504-0C5A-4750-A1E7-A9046DEA8A21}
   ButtonText    = MoneySide   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
   ButtonText    = Messenger   : C:\Program Files\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
   {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address   : %SystemRoot%\System32\browseui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   IgfxTray   C:\WINDOWS\System32\igfxtray.exe
   HotKeysCmds   C:\WINDOWS\System32\hkcmd.exe
   BCMSMMSG   BCMSMMSG.exe
   dla   C:\WINDOWS\system32\dla\tfswctrl.exe
   StorageGuard   "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
   PCMService   "C:\Program Files\Dell\Media Experience\PCMService.exe"
   TkBellExe   "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
   mmtask   c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
   DwlClient   C:\Program Files\Common Files\Dell\EUSW\Support.exe
   vptray   C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
   HPDJ Taskbar Utility   C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
   HP Component Manager   "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
   HP Software Update   "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
   DeviceDiscovery   C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
   iTunesHelper   C:\Program Files\iTunes\iTunesHelper.exe
   QuickTime Task   "C:\Program Files\QuickTime\qttask.exe" -atboottime
   PinnacleDriverCheck   C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
   NeroFilterCheck   C:\WINDOWS\system32\NeroCheck.exe
   gcasServ   "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
   wdjockb   C:\WINDOWS\system32\ijvahtn.exe r
   System service62   C:\WINDOWS\etb\pokapoka62.exe
   System service63   C:\WINDOWS\etb\pokapoka63.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
   IMAIL   Installed = 1
   MAPI   Installed = 1
   MSFS   Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   Sonic RecordNow!
   MSMSGS   "C:\Program Files\Messenger\msmsgs.exe" /background
   ctfmon.exe   C:\WINDOWS\system32\ctfmon.exe
   PhotoShow Deluxe Media Manager   C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
   {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
   {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
   {0DF44EAA-FF21-4412-828E-260A8728E7F1} =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
   dontdisplaylastusername   0
   legalnoticecaption
   legalnoticetext
   shutdownwithoutlogon   1
   undockwithoutlogon   1

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
   NoDriveTypeAutoRun   145

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
   PostBootReminder    {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
   CDBurn    {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
   WebCheck    {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
   SysTray     {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   UserInit   = C:\WINDOWS\system32\userinit.exe,
   Shell      = Explorer.exe
   System      =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
    = crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
    = cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
    = cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
    = sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
    = WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif
    = wzcdlg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
   Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
   AppInit_DLLs

»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.3.1   - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 8/30/2005 3:27:22 AM

Ewido report:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:         3:13:10 AM, 8/30/2005
+ Report-Checksum:      22C55781

+ Scan result:

   HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
   HKLM\SOFTWARE\Classes\CLSID\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
   HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{0F2A4ADC-DABF-4980-8DB4-19F67D7B1F95} -> Spyware.ClearSearch : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{49DB48FF-02B5-4645-B676-94A4DF1AA026} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{6E0ED53C-9908-49ED-B055-7CB31B162577} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{830D3AED-2FA9-454F-B266-D931862BBF34} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{8C53BD8E-B12D-4C8F-AD0E-C9DDC39D1273} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{9BCDD51B-4A7B-446C-8452-D32D38004582} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{A986F4DB-792E-4571-8974-0BB6E024766F} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{BCCAB53D-0895-40C3-A942-A03538CE227A} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{C0F88E9E-DCEB-4655-968A-AE508A677C39} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{D7EAC2D8-2D52-4010-A4AD-DFDF60C1706C} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\TypeLib\{5E594162-60A9-487D-84B8-DBDD716CB862} -> Spyware.VirtualBouncer : Cleaned with backup
   HKLM\SOFTWARE\Mvu -> Spyware.Delfin : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000049-8F91-4D9C-9573-F016E7626484} -> Spyware.BetterInternet : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> Spyware.BookedSpace : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12EE7A5E-0674-42F9-A76A-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12EE7A5E-0674-42F9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\{12EE7A5E-0674-42f9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   [504] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Cleaned with backup
   [728] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1044] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1476] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1504] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1616] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [464] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [236] C:\WINDOWS\system32\BCMSMI32.exe -> Spyware.UrlSpy : Cleaned with backup
   [328] C:\WINDOWS\system32\eetu.exe -> Spyware.PurityScan : Cleaned with backup
   [584] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [620] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [660] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [844] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1104] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1944] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1948] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1232] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1748] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2072] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2096] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2108] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2116] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2132] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2164] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2172] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2268] C:\WINDOWS\mm15201518.a.Stub.exe -> TrojanDownloader.Delmed.a : Cleaned with backup
   [2280] C:\WINDOWS\system32\cdfview6.exe -> Spyware.UrlSpy : Cleaned with backup
   [2404] C:\WINDOWS\system32\gqtrwe.exe -> Trojan.Agent.cp : Cleaned with backup
   [2576] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Cleaned with backup
   [2968] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3104] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3212] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3288] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3340] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3228] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   C:\backup.zip/aqferror.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/fqsperf.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/fwsperf.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/MJCUIA32.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/MZVCP70.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/xusp1res.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/guard.tmp -> Spyware.Look2Me : Cleaned with backup
   C:\Documents and Settings\Diane\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0D.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
   C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\23DB1846-5826-492D-B0ED-17BE50.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\39C511DA-4F91-42E5-ACE9-9820A1.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\3DFE7A7D-14FF-4B45-B8F5-FD1B87.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\67164142-49B2-4424-9A97-68D1E9.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\7CCF5757-C79C-4C19-8852-288F6A.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\98B6180C-3ABB-47E7-A2AD-8F27A2.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\B7DA74BE-0D07-4A48-A76D-FF8CDB.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\CA1EBF94-7188-40D2-90F2-33F7A8.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\CEA5C0E3-816F-4EB5-9340-ABED35.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\D17F7EDB-7568-40B0-B46F-AD5240.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\DB7A944B-A326-4441-8ED8-5DCA01.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\E663D870-C167-484F-B2FA-4F8E34.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\EC602F1E-C03E-4F3D-AA3D-555E8B.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\EE7302ED-BD1B-4C75-8B49-629D75.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\1E2FCDDF-E79C-4D56-B165-070F4A\02587D5C-B274-4326-A392-0B8634 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\1F48A49B-055A-4217-8993-88CA08\F139AD58-32B4-4C1C-A77C-A75A4B -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\2957B66E-19D2-45F0-B612-863909\4A7A58C1-EEE5-4884-BCF5-97CE02 -> TrojanDownloader.Intexp.d : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\40C6B4E7-0397-4BE1-8B1E-7EA6BA\19B58DB1-4889-4BFB-87BF-406194 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\36AA3185-8FCB-4991-A858-0E1DC4 -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\498CFDD1-36F0-4D05-8091-94B985 -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\69869A5E-7C08-4194-A9AB-C2F40F -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\571486C9-114E-4BFB-A369-494B0C\2356C1E8-F338-4110-B9CA-D93329 -> Spyware.HotSearchBar : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\74BA0F94-FACC-4C37-A345-5AE078\34CE9A63-2D06-48FD-B497-85F995 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\83CA31AC-DFA2-47B9-B45B-207357\CCA97BAB-28E8-407D-9B9B-142C9A -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\88094097-84CB-4193-A9E1-A4EE5C\3A4D2614-A2B6-4FCD-A02F-0CDCC6 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\8EAE4A62-47A4-44E0-895F-B2A703\05599AB3-BE35-4FB8-BE5E-B7FD5A -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\9E4E6738-0AF5-4DBF-847D-DAD7C9\2C747CB6-3916-43B7-8AC5-3D6AE7 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\A1034FEB-E5C4-4DC1-A3B2-223844\66128A89-67F4-4AC0-9695-5C5364 -> Spyware.BookedSpace : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\BF877A7E-FBF1-4B31-B1E4-110C5E\8ED56E3C-67AA-4AA8-805D-0721D2 -> Trojan.Agent.gp : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\C7D5259E-31DD-483E-91CC-A9DC3C\D9EE1D13-AD5C-43CE-843E-DA73B1 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\DF44257A-D788-437A-BDFF-43C7DC\02D0847A-6C8B-47EF-B43C-9485FB -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\F5E8565D-22E2-4933-B4E2-E3FB78\C565898A-0A78-4107-B9B8-580897 -> Spyware.BookedSpace : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\F9FB55B6-920B-4B8D-A11F-2D0EA0\DDC34558-CD7F-4ED8-8B79-62C69C -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007595.exe -> TrojanDropper.Agent.hl : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007614.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007617.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008817.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008843.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008863.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0009867.exe -> TrojanDownloader.Adload.a : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP119\A0010090.sys -> Trojan.Rootkit.Agent.af : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP120\A0010141.sys -> Trojan.Rootkit.Agent.af : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP121\A0010265.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP121\A0010266.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010341.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010342.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010379.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010380.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010394.exe -> Spyware.AdURL : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP126\A0010412.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010442.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010443.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010446.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010449.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010491.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010492.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010495.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010497.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP130\A0010526.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP130\A0010527.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010555.exe -> Spyware.ISearch : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010565.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010566.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010570.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010575.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010582.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010583.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010606.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010610.vxd -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010611.srg -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010635.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010637.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010640.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010642.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010670.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010672.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010688.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010696.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010697.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010710.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010723.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010725.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0010756.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010764.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010779.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010780.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010796.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010811.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010814.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010815.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010817.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010830.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010832.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011828.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011830.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011838.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011868.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011886.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011887.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011905.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP138\A0011980.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP138\A0012019.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012033.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012036.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012067.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012069.exe -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012070.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012082.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012104.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012105.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012133.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012135.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012138.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012166.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP142\A0012182.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP142\A0012183.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012208.exe -> TrojanDownloader.QDown.z : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012219.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012221.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012230.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012250.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012254.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012255.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012256.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012267.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012278.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012279.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012281.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012289.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012291.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0012294.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013267.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013278.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013279.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013280.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013282.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013287.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013298.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013308.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013310.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013311.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013313.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013336.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013337.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013338.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013340.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013350.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013357.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013413.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013415.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013416.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013418.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013428.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013451.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013453.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013454.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013472.dll -> Trojan.Agent.db : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013490.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013492.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013493.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013495.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013503.exe -> Adware.BetterInternet : Cleaned with backup
   C:

Guest · « **Reply #11 on:** August 30, 2005, 09:05:34 AM »

For some reason all reports did not get through on the post. here they are again:

recent HiJack this:

Logfile of HijackThis v1.99.1
Scan saved at 9:57:53 AM, on 8/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\azflozd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Paul\Desktop\software stuff\HijackThis adaware etc\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [erbhhuz] C:\WINDOWS\system32\azflozd.exe r
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\lsddsl.exe reg_run
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

Ewido:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:         3:13:10 AM, 8/30/2005
+ Report-Checksum:      22C55781

+ Scan result:

   HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
   HKLM\SOFTWARE\Classes\CLSID\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
   HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{0F2A4ADC-DABF-4980-8DB4-19F67D7B1F95} -> Spyware.ClearSearch : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{49DB48FF-02B5-4645-B676-94A4DF1AA026} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{6E0ED53C-9908-49ED-B055-7CB31B162577} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{830D3AED-2FA9-454F-B266-D931862BBF34} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{8C53BD8E-B12D-4C8F-AD0E-C9DDC39D1273} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{9BCDD51B-4A7B-446C-8452-D32D38004582} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{A986F4DB-792E-4571-8974-0BB6E024766F} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{BCCAB53D-0895-40C3-A942-A03538CE227A} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{C0F88E9E-DCEB-4655-968A-AE508A677C39} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{D7EAC2D8-2D52-4010-A4AD-DFDF60C1706C} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\TypeLib\{5E594162-60A9-487D-84B8-DBDD716CB862} -> Spyware.VirtualBouncer : Cleaned with backup
   HKLM\SOFTWARE\Mvu -> Spyware.Delfin : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000049-8F91-4D9C-9573-F016E7626484} -> Spyware.BetterInternet : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> Spyware.BookedSpace : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12EE7A5E-0674-42F9-A76A-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12EE7A5E-0674-42F9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\{12EE7A5E-0674-42f9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   [504] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Cleaned with backup
   [728] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1044] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1476] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1504] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1616] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [464] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [236] C:\WINDOWS\system32\BCMSMI32.exe -> Spyware.UrlSpy : Cleaned with backup
   [328] C:\WINDOWS\system32\eetu.exe -> Spyware.PurityScan : Cleaned with backup
   [584] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [620] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [660] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [844] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1104] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1944] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1948] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1232] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1748] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2072] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2096] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2108] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2116] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2132] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2164] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2172] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2268] C:\WINDOWS\mm15201518.a.Stub.exe -> TrojanDownloader.Delmed.a : Cleaned with backup
   [2280] C:\WINDOWS\system32\cdfview6.exe -> Spyware.UrlSpy : Cleaned with backup
   [2404] C:\WINDOWS\system32\gqtrwe.exe -> Trojan.Agent.cp : Cleaned with backup
   [2576] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Cleaned with backup
   [2968] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3104] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3212] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3288] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3340] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3228] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   C:\backup.zip/aqferror.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/fqsperf.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/fwsperf.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/MJCUIA32.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/MZVCP70.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/xusp1res.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/guard.tmp -> Spyware.Look2Me : Cleaned with backup
   C:\Documents and Settings\Diane\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0D.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
   C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\23DB1846-5826-492D-B0ED-17BE50.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\39C511DA-4F91-42E5-ACE9-9820A1.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\3DFE7A7D-14FF-4B45-B8F5-FD1B87.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\67164142-49B2-4424-9A97-68D1E9.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\7CCF5757-C79C-4C19-8852-288F6A.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\98B6180C-3ABB-47E7-A2AD-8F27A2.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\B7DA74BE-0D07-4A48-A76D-FF8CDB.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\CA1EBF94-7188-40D2-90F2-33F7A8.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\CEA5C0E3-816F-4EB5-9340-ABED35.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\D17F7EDB-7568-40B0-B46F-AD5240.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\DB7A944B-A326-4441-8ED8-5DCA01.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\E663D870-C167-484F-B2FA-4F8E34.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\EC602F1E-C03E-4F3D-AA3D-555E8B.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\EE7302ED-BD1B-4C75-8B49-629D75.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\1E2FCDDF-E79C-4D56-B165-070F4A\02587D5C-B274-4326-A392-0B8634 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\1F48A49B-055A-4217-8993-88CA08\F139AD58-32B4-4C1C-A77C-A75A4B -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\2957B66E-19D2-45F0-B612-863909\4A7A58C1-EEE5-4884-BCF5-97CE02 -> TrojanDownloader.Intexp.d : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\40C6B4E7-0397-4BE1-8B1E-7EA6BA\19B58DB1-4889-4BFB-87BF-406194 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\36AA3185-8FCB-4991-A858-0E1DC4 -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\498CFDD1-36F0-4D05-8091-94B985 -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\69869A5E-7C08-4194-A9AB-C2F40F -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\571486C9-114E-4BFB-A369-494B0C\2356C1E8-F338-4110-B9CA-D93329 -> Spyware.HotSearchBar : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\74BA0F94-FACC-4C37-A345-5AE078\34CE9A63-2D06-48FD-B497-85F995 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\83CA31AC-DFA2-47B9-B45B-207357\CCA97BAB-28E8-407D-9B9B-142C9A -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\88094097-84CB-4193-A9E1-A4EE5C\3A4D2614-A2B6-4FCD-A02F-0CDCC6 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\8EAE4A62-47A4-44E0-895F-B2A703\05599AB3-BE35-4FB8-BE5E-B7FD5A -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\9E4E6738-0AF5-4DBF-847D-DAD7C9\2C747CB6-3916-43B7-8AC5-3D6AE7 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\A1034FEB-E5C4-4DC1-A3B2-223844\66128A89-67F4-4AC0-9695-5C5364 -> Spyware.BookedSpace : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\BF877A7E-FBF1-4B31-B1E4-110C5E\8ED56E3C-67AA-4AA8-805D-0721D2 -> Trojan.Agent.gp : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\C7D5259E-31DD-483E-91CC-A9DC3C\D9EE1D13-AD5C-43CE-843E-DA73B1 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\DF44257A-D788-437A-BDFF-43C7DC\02D0847A-6C8B-47EF-B43C-9485FB -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\F5E8565D-22E2-4933-B4E2-E3FB78\C565898A-0A78-4107-B9B8-580897 -> Spyware.BookedSpace : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\F9FB55B6-920B-4B8D-A11F-2D0EA0\DDC34558-CD7F-4ED8-8B79-62C69C -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007595.exe -> TrojanDropper.Agent.hl : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007614.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007617.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008817.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008843.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008863.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0009867.exe -> TrojanDownloader.Adload.a : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP119\A0010090.sys -> Trojan.Rootkit.Agent.af : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP120\A0010141.sys -> Trojan.Rootkit.Agent.af : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP121\A0010265.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP121\A0010266.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010341.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010342.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010379.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010380.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010394.exe -> Spyware.AdURL : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP126\A0010412.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010442.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010443.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010446.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010449.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010491.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010492.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010495.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010497.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP130\A0010526.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP130\A0010527.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010555.exe -> Spyware.ISearch : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010565.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010566.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010570.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010575.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010582.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010583.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010606.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010610.vxd -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010611.srg -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010635.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010637.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010640.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010642.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010670.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010672.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010688.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010696.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010697.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010710.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010723.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010725.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0010756.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010764.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010779.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010780.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010796.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010811.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010814.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010815.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010817.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010830.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010832.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011828.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011830.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011838.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011868.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011886.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011887.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011905.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP138\A0011980.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP138\A0012019.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012033.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012036.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012067.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012069.exe -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012070.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012082.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012104.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012105.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012133.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012135.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012138.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012166.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP142\A0012182.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP142\A0012183.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012208.exe -> TrojanDownloader.QDown.z : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012219.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012221.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012230.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012250.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012254.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012255.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012256.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012267.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012278.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012279.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012281.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012289.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012291.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0012294.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013267.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013278.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013279.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013280.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013282.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013287.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013298.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013308.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013310.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013311.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013313.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013336.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013337.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013338.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013340.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013350.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013357.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013413.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013415.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013416.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013418.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013428.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013451.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013453.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013454.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013472.dll -> Trojan.Agent.db : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013490.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013492.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013493.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013495.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013503.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013508.exe -> Trojan.Stervis.d : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013516.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013526.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013527.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013528.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013546.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013548.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013549.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013551.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013562.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014546.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014547.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014548.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014550.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014554.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014569.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014570.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014573.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014577.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014578.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014587.dll -> Trojan.Agent.db : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014601.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014603.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014608.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014610.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014611.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014613.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014622.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014624.exe -> Trojan.Stervis.d : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0014629.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015592.exe -> TrojanDownloader.Adload.a : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015596.exe -> Spyware.ISearch : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015597.exe -> TrojanDropper.Agent.hl : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015600.exe -> TrojanDownloader.Delmed.a : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015603.exe -> Spyware.UrlSpy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015607.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015608.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015609.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015623.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015624.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015626.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015633.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015690.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015693.exe -> TrojanDownloader.Small.abd : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015694.exe -> TrojanDownloader.Small.abd : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015695.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015696.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015697.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015698.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0015715.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016592.dll -> Spyware.WinAD : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016601.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016602.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016603.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016604.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016607.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016608.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016609.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016611.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016621.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017597.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017599.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017600.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017601.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017603.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017605.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017606.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017607.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017609.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017610.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017621.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018594.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018595.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018597.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018599.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018600.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018602.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018603.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018605.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018608.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018614.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018619.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018626.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018631.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018633.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018635.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018639.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018640.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018641.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018643.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018645.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018647.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018653.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018661.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018663.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018664.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018667.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018668.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018669.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018670.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018672.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018680.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018692.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018693.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018695.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018697.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018699.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018700.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018702.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018704.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018712.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019688.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019690.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019691.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019696.exe -&

physicsforfun · « **Reply #12 on:** August 30, 2005, 09:27:49 AM »

Maybe there is a problem because I did not log in...SO here are the 3 reports again....along with my previous comments:

I did as you said, but could not boot up in safe mode. I got the IRQL_NOT_LESS_OR_EQUAL blue screen of death. So I went ahead with the C:\WINDOWS...file deletions in normal mode. I could delete all the files I found except mm15201518.a.stub.exe. That file could not be deleted because it was running or for some other exception. SO I just went ahead and did everything else you specified.

WINDPFIND

physicsforfun · « **Reply #13 on:** August 30, 2005, 09:30:19 AM »

Maybe there is a problem because I did not log in...SO here are the 3 reports again....along with my previous comments:

I did as you said, but could not boot up in safe mode. I got the IRQL_NOT_LESS_OR_EQUAL blue screen of death. So I went ahead with the C:\WINDOWS...file deletions in normal mode. I could delete all the files I found except mm15201518.a.stub.exe. That file could not be deleted because it was running or for some other exception. SO I just went ahead and did everything else you specified.

WINDPFIND:

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
PECompact2 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\lpt$vpn.797
qoologic 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\lpt$vpn.797
SAHAgent 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\lpt$vpn.797
UPX! 5/3/2005 11:44:44 AM 25157 C:\WINDOWS\RMAgentOutput.dll
UPX! 1/10/2005 4:17:24 PM 170053 C:\WINDOWS\tsc.exe
PECompact2 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\VPTNFILE.797
qoologic 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\VPTNFILE.797
SAHAgent 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\VPTNFILE.797
UPX! 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll
aspack 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll

Checking %System% folder...
UPX! 11/22/2002 11:21:28 AM 123904 C:\WINDOWS\SYSTEM32\avisynth.dll
UPX! 9/17/2001 2:20:02 PM 9216 C:\WINDOWS\SYSTEM32\cpuinf32.dll
69.59.186.63 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
209.66.67.134 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
66.63.167.97 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
66.63.167.77 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
web-nex 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
winsync 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
rec2_run 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
PEC2 8/29/2002 7:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
UPX! 11/24/2001 3:31:48 PM 65536 C:\WINDOWS\SYSTEM32\DVDAudio.ax
UPX! 11/24/2001 3:28:14 PM 86528 C:\WINDOWS\SYSTEM32\DVDVideo.ax
UPX! 2/20/2004 6:49:02 PM 77312 C:\WINDOWS\SYSTEM32\Ia1cm.dll
PTech 7/12/2005 5:50:44 PM 520456 C:\WINDOWS\SYSTEM32\LegitCheckControl.DLL
PECompact2 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2004 3:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 8/4/2004 3:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 8/29/2002 7:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\WBDBASE.DEU
UPX! 8/30/2005 2:05:42 AM 82432 C:\WINDOWS\SYSTEM32\__delete_on_reboot__eetu.exe

Checking %System%\Drivers folder and sub-folders...
PTech 8/4/2004 1:41:38 AM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\ETC\hosts

Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
8/30/2005 2:05:12 AM S 2048 C:\WINDOWS\BOOTSTAT.DAT
7/27/2005 9:43:58 AM H 10820 C:\WINDOWS\Help\update.GID
8/29/2005 11:35:06 PM H 335 C:\WINDOWS\SYSTEM32\vsconfig.xml
7/8/2005 4:23:18 PM S 12143 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB893756.cat
7/19/2005 7:18:10 PM S 18913 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896727.cat
7/2/2005 4:18:16 AM S 9445 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB903235.cat
8/30/2005 3:01:16 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
8/30/2005 2:05:38 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
8/30/2005 2:15:22 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
8/30/2005 3:23:28 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
8/30/2005 3:02:34 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
8/11/2005 3:01:34 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\NTUSER.DAT.LOG
8/30/2005 2:05:44 AM HS 192 C:\WINDOWS\Tasks\RUTASK.job
8/30/2005 2:05:16 AM H 6 C:\WINDOWS\Tasks\SA.DAT
8/19/2005 12:43:54 PM HS 113 C:\WINDOWS\Temp\History\History.IE5\desktop.ini
8/19/2005 12:43:54 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\1T8AO7D3\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\8DQ78PUJ\desktop.ini
8/19/2005 5:10:16 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\8XUVGXIJ\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\DQF1XA02\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\FACFJXWH\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KL0ZK34V\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KP6ZWT2J\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KPQZ4PAR\desktop.ini
8/19/2005 5:10:18 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\OHERKTYF\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\QL0BML25\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\UMB9DBLF\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\UPD2RMD8\desktop.ini

Checking for CPL files...
Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Broadcom Corporation 5/8/2003 9:25:18 PM 815104 C:\WINDOWS\SYSTEM32\B57exp.cpl
Broadcom Corporation 6/3/2003 12:38:44 PM 94208 C:\WINDOWS\SYSTEM32\BCMSM.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
FotoNation inc. 3/26/1998 2:01:34 PM 27136 C:\WINDOWS\SYSTEM32\camcpl.cpl
8/23/2005 7:49:04 PM 31232 C:\WINDOWS\SYSTEM32\conres.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Intel Corporation 4/7/2003 2:14:30 AM 94208 C:\WINDOWS\SYSTEM32\igfxcpl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems 12/28/2003 6:43:24 PM 53352 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 8/29/2002 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\MAIN.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Kristal Studio 3/2/2001 10:39:28 PM 121856 C:\WINDOWS\SYSTEM32\Mp3cnfg.cpl
Microsoft Corporation 8/29/2002 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\NCPA.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
Apple Computer, Inc. 4/8/2004 2:12:42 PM 323072 C:\WINDOWS\SYSTEM32\QuickTime.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 8/29/2002 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\TELEPHON.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\DLLCACHE\wuaucpl.cpl
Intel Corporation 4/7/2003 2:14:30 AM 94208 C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxcpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
1/20/2004 10:18:02 PM 950 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
9/3/2002 11:00:00 AM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI
1/20/2004 9:00:52 PM 1770 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
5/23/2004 6:15:04 PM 1798 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microtek Scanner Finder.lnk
1/20/2004 9:51:36 PM 782 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ZoneAlarm Pro.lnk

Checking files in %ALLUSERSPROFILE%\Application Data folder...
9/3/2002 10:50:46 AM HS 62 C:\Documents and Settings\All Users\Application Data\DESKTOP.INI

Checking files in %USERPROFILE%\Startup folder...
9/3/2002 11:00:00 AM HS 84 C:\Documents and Settings\Paul\Start Menu\Programs\Startup\DESKTOP.INI

Checking files in %USERPROFILE%\Application Data folder...
9/3/2002 10:50:46 AM HS 62 C:\Documents and Settings\Paul\Application Data\DESKTOP.INI
11/19/2004 11:41:36 AM 61408 C:\Documents and Settings\Paul\Application Data\GDIPFONTCACHEV1.DAT

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
   SV1    =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\fxqkmfgg
   {a10b8124-d9fb-4b39-a065-1ada59a38197}    = C:\WINDOWS\system32\jabke.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\LDVPMenu
   {BDA77241-42F6-11d0-85E2-00AA001FE28C}    = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
   {750fdf0e-2a26-11d1-a3ea-080036587f03}    = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
   {09799AFB-AD67-11d1-ABCD-00C04FC30936}    = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
   {A470F8CF-A1E8-4f65-8335-227475AA5C46}    = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
   Start Menu Pin    = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\LDVPMenu
   {BDA77241-42F6-11d0-85E2-00AA001FE28C}    = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
   {A470F8CF-A1E8-4f65-8335-227475AA5C46}    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
   {750fdf0e-2a26-11d1-a3ea-080036587f03}    = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
   {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}    = ntshrui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
    = %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
   &Tip of the Day = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
   Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
   MenuText    = Sun Java Console   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45}
   ButtonText    = AIM   : C:\Program Files\AIM\aim.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
   ButtonText    = PartyPoker.com   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
   ButtonText    = Real.com   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E023F504-0C5A-4750-A1E7-A9046DEA8A21}
   ButtonText    = MoneySide   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
   ButtonText    = Messenger   : C:\Program Files\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
   {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address   : %SystemRoot%\System32\browseui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   IgfxTray   C:\WINDOWS\System32\igfxtray.exe
   HotKeysCmds   C:\WINDOWS\System32\hkcmd.exe
   BCMSMMSG   BCMSMMSG.exe
   dla   C:\WINDOWS\system32\dla\tfswctrl.exe
   StorageGuard   "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
   PCMService   "C:\Program Files\Dell\Media Experience\PCMService.exe"
   TkBellExe   "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
   mmtask   c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
   DwlClient   C:\Program Files\Common Files\Dell\EUSW\Support.exe
   vptray   C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
   HPDJ Taskbar Utility   C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
   HP Component Manager   "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
   HP Software Update   "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
   DeviceDiscovery   C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
   iTunesHelper   C:\Program Files\iTunes\iTunesHelper.exe
   QuickTime Task   "C:\Program Files\QuickTime\qttask.exe" -atboottime
   PinnacleDriverCheck   C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
   NeroFilterCheck   C:\WINDOWS\system32\NeroCheck.exe
   gcasServ   "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
   wdjockb   C:\WINDOWS\system32\ijvahtn.exe r
   System service62   C:\WINDOWS\etb\pokapoka62.exe
   System service63   C:\WINDOWS\etb\pokapoka63.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
   IMAIL   Installed = 1
   MAPI   Installed = 1
   MSFS   Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   Sonic RecordNow!
   MSMSGS   "C:\Program Files\Messenger\msmsgs.exe" /background
   ctfmon.exe   C:\WINDOWS\system32\ctfmon.exe
   PhotoShow Deluxe Media Manager   C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
   {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
   {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
   {0DF44EAA-FF21-4412-828E-260A8728E7F1} =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
   dontdisplaylastusername   0
   legalnoticecaption
   legalnoticetext
   shutdownwithoutlogon   1
   undockwithoutlogon   1

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
   NoDriveTypeAutoRun   145

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
   PostBootReminder    {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
   CDBurn    {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
   WebCheck    {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
   SysTray     {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   UserInit   = C:\WINDOWS\system32\userinit.exe,
   Shell      = Explorer.exe
   System      =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
    = crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
    = cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
    = cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
    = sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
    = WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif
    = wzcdlg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
   Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
   AppInit_DLLs

»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.3.1   - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 8/30/2005 3:27:22 AM

EWIDO

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:         3:13:10 AM, 8/30/2005
+ Report-Checksum:      22C55781

+ Scan result:

   HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
   HKLM\SOFTWARE\Classes\CLSID\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
   HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{0F2A4ADC-DABF-4980-8DB4-19F67D7B1F95} -> Spyware.ClearSearch : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{49DB48FF-02B5-4645-B676-94A4DF1AA026} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{6E0ED53C-9908-49ED-B055-7CB31B162577} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{830D3AED-2FA9-454F-B266-D931862BBF34} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{8C53BD8E-B12D-4C8F-AD0E-C9DDC39D1273} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{9BCDD51B-4A7B-446C-8452-D32D38004582} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{A986F4DB-792E-4571-8974-0BB6E024766F} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{BCCAB53D-0895-40C3-A942-A03538CE227A} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{C0F88E9E-DCEB-4655-968A-AE508A677C39} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{D7EAC2D8-2D52-4010-A4AD-DFDF60C1706C} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\TypeLib\{5E594162-60A9-487D-84B8-DBDD716CB862} -> Spyware.VirtualBouncer : Cleaned with backup
   HKLM\SOFTWARE\Mvu -> Spyware.Delfin : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000049-8F91-4D9C-9573-F016E7626484} -> Spyware.BetterInternet : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> Spyware.BookedSpace : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12EE7A5E-0674-42F9-A76A-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12EE7A5E-0674-42F9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\{12EE7A5E-0674-42f9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   [504] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Cleaned with backup
   [728] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1044] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1476] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1504] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1616] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [464] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [236] C:\WINDOWS\system32\BCMSMI32.exe -> Spyware.UrlSpy : Cleaned with backup
   [328] C:\WINDOWS\system32\eetu.exe -> Spyware.PurityScan : Cleaned with backup
   [584] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [620] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [660] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [844] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1104] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1944] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1948] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1232] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1748] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2072] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2096] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2108] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2116] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2132] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2164] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2172] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2268] C:\WINDOWS\mm15201518.a.Stub.exe -> TrojanDownloader.Delmed.a : Cleaned with backup
   [2280] C:\WINDOWS\system32\cdfview6.exe -> Spyware.UrlSpy : Cleaned with backup
   [2404] C:\WINDOWS\system32\gqtrwe.exe -> Trojan.Agent.cp : Cleaned with backup
   [2576] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Cleaned with backup
   [2968] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3104] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3212] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3288] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3340] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3228] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   C:\backup.zip/aqferror.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/fqsperf.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/fwsperf.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/MJCUIA32.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/MZVCP70.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/xusp1res.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/guard.tmp -> Spyware.Look2Me : Cleaned with backup
   C:\Documents and Settings\Diane\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0D.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
   C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\23DB1846-5826-492D-B0ED-17BE50.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\39C511DA-4F91-42E5-ACE9-9820A1.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\3DFE7A7D-14FF-4B45-B8F5-FD1B87.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\67164142-49B2-4424-9A97-68D1E9.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\7CCF5757-C79C-4C19-8852-288F6A.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\98B6180C-3ABB-47E7-A2AD-8F27A2.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\B7DA74BE-0D07-4A48-A76D-FF8CDB.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\CA1EBF94-7188-40D2-90F2-33F7A8.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\CEA5C0E3-816F-4EB5-9340-ABED35.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\D17F7EDB-7568-40B0-B46F-AD5240.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\DB7A944B-A326-4441-8ED8-5DCA01.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\E663D870-C167-484F-B2FA-4F8E34.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\EC602F1E-C03E-4F3D-AA3D-555E8B.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\EE7302ED-BD1B-4C75-8B49-629D75.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\1E2FCDDF-E79C-4D56-B165-070F4A\02587D5C-B274-4326-A392-0B8634 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\1F48A49B-055A-4217-8993-88CA08\F139AD58-32B4-4C1C-A77C-A75A4B -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\2957B66E-19D2-45F0-B612-863909\4A7A58C1-EEE5-4884-BCF5-97CE02 -> TrojanDownloader.Intexp.d : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\40C6B4E7-0397-4BE1-8B1E-7EA6BA\19B58DB1-4889-4BFB-87BF-406194 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\36AA3185-8FCB-4991-A858-0E1DC4 -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\498CFDD1-36F0-4D05-8091-94B985 -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\69869A5E-7C08-4194-A9AB-C2F40F -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\571486C9-114E-4BFB-A369-494B0C\2356C1E8-F338-4110-B9CA-D93329 -> Spyware.HotSearchBar : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\74BA0F94-FACC-4C37-A345-5AE078\34CE9A63-2D06-48FD-B497-85F995 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\83CA31AC-DFA2-47B9-B45B-207357\CCA97BAB-28E8-407D-9B9B-142C9A -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\88094097-84CB-4193-A9E1-A4EE5C\3A4D2614-A2B6-4FCD-A02F-0CDCC6 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\8EAE4A62-47A4-44E0-895F-B2A703\05599AB3-BE35-4FB8-BE5E-B7FD5A -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\9E4E6738-0AF5-4DBF-847D-DAD7C9\2C747CB6-3916-43B7-8AC5-3D6AE7 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\A1034FEB-E5C4-4DC1-A3B2-223844\66128A89-67F4-4AC0-9695-5C5364 -> Spyware.BookedSpace : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\BF877A7E-FBF1-4B31-B1E4-110C5E\8ED56E3C-67AA-4AA8-805D-0721D2 -> Trojan.Agent.gp : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\C7D5259E-31DD-483E-91CC-A9DC3C\D9EE1D13-AD5C-43CE-843E-DA73B1 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\DF44257A-D788-437A-BDFF-43C7DC\02D0847A-6C8B-47EF-B43C-9485FB -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\F5E8565D-22E2-4933-B4E2-E3FB78\C565898A-0A78-4107-B9B8-580897 -> Spyware.BookedSpace : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\F9FB55B6-920B-4B8D-A11F-2D0EA0\DDC34558-CD7F-4ED8-8B79-62C69C -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007595.exe -> TrojanDropper.Agent.hl : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007614.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007617.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008817.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008843.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008863.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0009867.exe -> TrojanDownloader.Adload.a : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP119\A0010090.sys -> Trojan.Rootkit.Agent.af : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP120\A0010141.sys -> Trojan.Rootkit.Agent.af : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP121\A0010265.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP121\A0010266.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010341.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010342.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010379.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010380.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010394.exe -> Spyware.AdURL : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP126\A0010412.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010442.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010443.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010446.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010449.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010491.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010492.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010495.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010497.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP130\A0010526.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP130\A0010527.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010555.exe -> Spyware.ISearch : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010565.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010566.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010570.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010575.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010582.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010583.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010606.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010610.vxd -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010611.srg -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010635.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010637.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010640.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010642.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010670.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010672.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010688.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010696.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010697.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010710.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010723.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010725.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0010756.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010764.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010779.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010780.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010796.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010811.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010814.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010815.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010817.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010830.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010832.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011828.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011830.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011838.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011868.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011886.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011887.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011905.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP138\A0011980.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP138\A0012019.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012033.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012036.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012067.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012069.exe -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012070.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012082.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012104.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012105.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012133.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012135.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012138.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012166.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP142\A0012182.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP142\A0012183.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012208.exe -> TrojanDownloader.QDown.z : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012219.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012221.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012230.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012250.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012254.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012255.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012256.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012267.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012278.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012279.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012281.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012289.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012291.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0012294.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013267.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013278.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013279.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013280.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013282.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013287.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013298.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013308.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013310.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013311.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013313.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013336.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013337.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013338.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013340.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013350.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013357.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013413.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013415.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013416.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013418.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013428.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013451.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013453.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013454.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013472.dll -> Trojan.Agent.db : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013490.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013492.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013493.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013495.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Sys

physicsforfun · « **Reply #14 on:** August 30, 2005, 09:34:39 AM »

Let's see if I can post just the Ewido file. It seems to big to post. Is this possible???

Ewido:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:         3:13:10 AM, 8/30/2005
+ Report-Checksum:      22C55781

+ Scan result:

   HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
   HKLM\SOFTWARE\Classes\CLSID\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
   HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{6EC11407-5B2E-4E25-8BDF-77445B52AB37} -> Spyware.VX2 : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{0F2A4ADC-DABF-4980-8DB4-19F67D7B1F95} -> Spyware.ClearSearch : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{49DB48FF-02B5-4645-B676-94A4DF1AA026} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{6E0ED53C-9908-49ED-B055-7CB31B162577} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{830D3AED-2FA9-454F-B266-D931862BBF34} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{8C53BD8E-B12D-4C8F-AD0E-C9DDC39D1273} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{9BCDD51B-4A7B-446C-8452-D32D38004582} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{A986F4DB-792E-4571-8974-0BB6E024766F} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{BCCAB53D-0895-40C3-A942-A03538CE227A} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{C0F88E9E-DCEB-4655-968A-AE508A677C39} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\Interface\{D7EAC2D8-2D52-4010-A4AD-DFDF60C1706C} -> Spyware.SecondThought : Cleaned with backup
   HKLM\SOFTWARE\Classes\TypeLib\{5E594162-60A9-487D-84B8-DBDD716CB862} -> Spyware.VirtualBouncer : Cleaned with backup
   HKLM\SOFTWARE\Mvu -> Spyware.Delfin : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000049-8F91-4D9C-9573-F016E7626484} -> Spyware.BetterInternet : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> Spyware.BookedSpace : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12EE7A5E-0674-42F9-A76A-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12EE7A5E-0674-42F9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   HKU\S-1-5-21-31632964-1887330575-3875628783-1009\Software\{12EE7A5E-0674-42f9-A76B-000000004D00} -> Spyware.BrowserAid : Cleaned with backup
   [504] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Cleaned with backup
   [728] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1044] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1476] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1504] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1616] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [464] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [236] C:\WINDOWS\system32\BCMSMI32.exe -> Spyware.UrlSpy : Cleaned with backup
   [328] C:\WINDOWS\system32\eetu.exe -> Spyware.PurityScan : Cleaned with backup
   [584] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [620] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [660] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [844] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1104] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1944] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1948] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1232] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [1748] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2072] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2096] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2108] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2116] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2132] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2164] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2172] C:\WINDOWS\etb\nt_hide63.dll -> Spyware.EliteBar : Error during cleaning
   [2268] C:\WINDOWS\mm15201518.a.Stub.exe -> TrojanDownloader.Delmed.a : Cleaned with backup
   [2280] C:\WINDOWS\system32\cdfview6.exe -> Spyware.UrlSpy : Cleaned with backup
   [2404] C:\WINDOWS\system32\gqtrwe.exe -> Trojan.Agent.cp : Cleaned with backup
   [2576] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Cleaned with backup
   [2968] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3104] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3212] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3288] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3340] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   [3228] C:\WINDOWS\etb\nt_hide62.dll -> Spyware.EliteBar : Error during cleaning
   C:\backup.zip/aqferror.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/fqsperf.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/fwsperf.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/MJCUIA32.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/MZVCP70.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/xusp1res.dll -> Spyware.Look2Me : Cleaned with backup
   C:\backup.zip/guard.tmp -> Spyware.Look2Me : Cleaned with backup
   C:\Documents and Settings\Diane\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0D.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
   C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\23DB1846-5826-492D-B0ED-17BE50.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\39C511DA-4F91-42E5-ACE9-9820A1.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\3DFE7A7D-14FF-4B45-B8F5-FD1B87.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\67164142-49B2-4424-9A97-68D1E9.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\7CCF5757-C79C-4C19-8852-288F6A.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\98B6180C-3ABB-47E7-A2AD-8F27A2.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\B7DA74BE-0D07-4A48-A76D-FF8CDB.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\CA1EBF94-7188-40D2-90F2-33F7A8.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\CEA5C0E3-816F-4EB5-9340-ABED35.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\D17F7EDB-7568-40B0-B46F-AD5240.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\DB7A944B-A326-4441-8ED8-5DCA01.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\E663D870-C167-484F-B2FA-4F8E34.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\EC602F1E-C03E-4F3D-AA3D-555E8B.asq -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\DeactivatedItems\EE7302ED-BD1B-4C75-8B49-629D75.asq -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\1E2FCDDF-E79C-4D56-B165-070F4A\02587D5C-B274-4326-A392-0B8634 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\1F48A49B-055A-4217-8993-88CA08\F139AD58-32B4-4C1C-A77C-A75A4B -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\2957B66E-19D2-45F0-B612-863909\4A7A58C1-EEE5-4884-BCF5-97CE02 -> TrojanDownloader.Intexp.d : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\40C6B4E7-0397-4BE1-8B1E-7EA6BA\19B58DB1-4889-4BFB-87BF-406194 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\36AA3185-8FCB-4991-A858-0E1DC4 -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\498CFDD1-36F0-4D05-8091-94B985 -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\4973A9E7-889E-43A1-8A7C-F618F8\69869A5E-7C08-4194-A9AB-C2F40F -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\571486C9-114E-4BFB-A369-494B0C\2356C1E8-F338-4110-B9CA-D93329 -> Spyware.HotSearchBar : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\74BA0F94-FACC-4C37-A345-5AE078\34CE9A63-2D06-48FD-B497-85F995 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\83CA31AC-DFA2-47B9-B45B-207357\CCA97BAB-28E8-407D-9B9B-142C9A -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\88094097-84CB-4193-A9E1-A4EE5C\3A4D2614-A2B6-4FCD-A02F-0CDCC6 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\8EAE4A62-47A4-44E0-895F-B2A703\05599AB3-BE35-4FB8-BE5E-B7FD5A -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\9E4E6738-0AF5-4DBF-847D-DAD7C9\2C747CB6-3916-43B7-8AC5-3D6AE7 -> Adware.BetterInternet : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\A1034FEB-E5C4-4DC1-A3B2-223844\66128A89-67F4-4AC0-9695-5C5364 -> Spyware.BookedSpace : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\BF877A7E-FBF1-4B31-B1E4-110C5E\8ED56E3C-67AA-4AA8-805D-0721D2 -> Trojan.Agent.gp : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\C7D5259E-31DD-483E-91CC-A9DC3C\D9EE1D13-AD5C-43CE-843E-DA73B1 -> Trojan.Agent.db : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\DF44257A-D788-437A-BDFF-43C7DC\02D0847A-6C8B-47EF-B43C-9485FB -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\F5E8565D-22E2-4933-B4E2-E3FB78\C565898A-0A78-4107-B9B8-580897 -> Spyware.BookedSpace : Cleaned with backup
   C:\Program Files\Microsoft AntiSpyware\Quarantine\F9FB55B6-920B-4B8D-A11F-2D0EA0\DDC34558-CD7F-4ED8-8B79-62C69C -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007595.exe -> TrojanDropper.Agent.hl : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007614.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP113\A0007617.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008817.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008843.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0008863.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP117\A0009867.exe -> TrojanDownloader.Adload.a : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP119\A0010090.sys -> Trojan.Rootkit.Agent.af : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP120\A0010141.sys -> Trojan.Rootkit.Agent.af : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP121\A0010265.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP121\A0010266.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010341.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010342.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010379.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010380.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP124\A0010394.exe -> Spyware.AdURL : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP126\A0010412.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010442.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010443.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010446.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP127\A0010449.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010491.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010492.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010495.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP129\A0010497.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP130\A0010526.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP130\A0010527.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010555.exe -> Spyware.ISearch : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010565.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010566.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010570.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010575.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010582.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP131\A0010583.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010606.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010610.vxd -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010611.srg -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010635.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010637.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010640.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP132\A0010642.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010670.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010672.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010688.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010696.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010697.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010710.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010723.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP133\A0010725.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP134\A0010756.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010764.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010779.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010780.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP135\A0010796.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010811.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010814.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010815.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010817.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010830.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0010832.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011828.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011830.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP136\A0011838.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011868.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011886.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011887.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP137\A0011905.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP138\A0011980.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP138\A0012019.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012033.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012036.dll -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012067.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012069.exe -> TrojanDownloader.Qoologic.aa : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP139\A0012070.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012082.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012104.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP140\A0012105.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012133.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012135.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012138.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP141\A0012166.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP142\A0012182.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP142\A0012183.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012208.exe -> TrojanDownloader.QDown.z : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012219.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012221.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP143\A0012230.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012250.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012254.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012255.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012256.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012267.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012278.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012279.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012281.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012289.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP144\A0012291.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0012294.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013267.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013278.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013279.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013280.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013282.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013287.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013298.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013308.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013310.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013311.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013313.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013336.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013337.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013338.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013340.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013350.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP145\A0013357.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013413.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013415.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013416.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013418.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP146\A0013428.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013451.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013453.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013454.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013472.dll -> Trojan.Agent.db : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013490.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013492.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013493.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013495.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013503.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP147\A0013508.exe -> Trojan.Stervis.d : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013516.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013526.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013527.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013528.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013546.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013548.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013549.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013551.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0013562.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014546.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014547.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014548.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014550.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP148\A0014554.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014569.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014570.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014573.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014577.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014578.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014587.dll -> Trojan.Agent.db : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014601.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014603.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014608.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014610.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014611.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014613.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014622.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP149\A0014624.exe -> Trojan.Stervis.d : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0014629.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015592.exe -> TrojanDownloader.Adload.a : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015596.exe -> Spyware.ISearch : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015597.exe -> TrojanDropper.Agent.hl : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015600.exe -> TrojanDownloader.Delmed.a : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015603.exe -> Spyware.UrlSpy : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015607.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015608.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015609.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015623.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015624.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015626.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP150\A0015633.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015690.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015693.exe -> TrojanDownloader.Small.abd : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015694.exe -> TrojanDownloader.Small.abd : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015695.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015696.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015697.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP151\A0015698.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0015715.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016592.dll -> Spyware.WinAD : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016601.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016602.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016603.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016604.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016607.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016608.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016609.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016611.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0016621.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017597.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017599.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017600.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017601.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017603.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017605.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017606.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017607.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017609.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017610.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0017621.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018594.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018595.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018597.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018599.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018600.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018602.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018603.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018605.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018608.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP152\A0018614.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018619.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018626.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018631.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018633.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018635.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018639.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018640.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018641.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018643.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018645.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018647.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018653.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018661.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018663.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018664.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018667.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018668.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018669.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018670.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018672.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018680.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018692.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018693.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018695.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018697.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018699.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018700.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018702.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018704.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0018712.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019688.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019690.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019691.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019696.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019697.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019698.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019700.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019702.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019703.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019706.exe -> TrojanDownloader.Intexp.d : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019707.exe -> Spyware.WinAD : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019708.exe -> Spyware.WinAD : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019709.dll -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019710.exe -> Trojan.Stervis.d : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019711.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP153\A0019712.dll -> Trojan.Agent.db : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020725.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020728.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020730.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020731.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020733.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020734.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020747.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020749.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020751.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020752.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020754.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020757.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020758.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020761.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020764.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020781.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020783.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020786.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020787.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020788.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020790.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020792.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020794.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020810.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP154\A0020819.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0021818.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0021820.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0021822.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0021824.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0021825.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0021827.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0021830.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0021836.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022813.exe -> TrojanDropper.Agent.lu : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022820.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022823.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022824.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022825.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022827.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022829.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022837.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022842.exe -> TrojanDropper.Agent.lu : Cleaned with backup
   C:\System Volume Info

physicsforfun · « **Reply #15 on:** August 30, 2005, 09:38:14 AM »

Here is the rest of the Ewido report:

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022842.exe -> TrojanDropper.Agent.lu : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022849.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022850.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022851.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022853.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022855.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022856.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022858.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022860.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022865.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022867.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022875.dll -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022878.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022885.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022887.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022889.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022890.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022893.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022894.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022896.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022899.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022914.exe -> TrojanDownloader.Small.aal : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022918.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022919.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022923.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022924.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022925.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022926.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022927.DLL -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022928.dll -> Spyware.Look2Me : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0022930.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP155\A0023063.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023070.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023071.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023073.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023087.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023088.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023092.exe -> Adware.BetterInternet : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023093.exe -> Trojan.Stervis.d : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023094.dll -> Trojan.Agent.db : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023096.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023101.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023102.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023105.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023106.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023107.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023110.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023112.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023375.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023376.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023380.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023382.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023383.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023384.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023386.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023388.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023397.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023398.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023401.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023402.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023403.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023405.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023406.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023409.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023455.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023456.exe -> Spyware.PurityScan : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023459.dll -> Spyware.EliteBar : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023460.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023461.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023462.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023463.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023465.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP156\A0023466.dll -> Spyware.EliteBar : Cleaned with backup
   C:\WINDOWS\cfgmgr52\EECH1.bsx -> Spyware.BookedSpace : Cleaned with backup
   C:\WINDOWS\cfgmgr52\SPZ3.bsx -> Spyware.BookedSpace : Cleaned with backup
   C:\WINDOWS\icont.exe -> Spyware.AdURL : Cleaned with backup
   C:\WINDOWS\mm15201518.a.Stub.exe -> TrojanDownloader.Delmed.a : Cleaned with backup
   C:\WINDOWS\ru.exe -> Spyware.PurityScan : Cleaned with backup
   C:\WINDOWS\SYSTEM32\b7s.dll -> Adware.eZula : Cleaned with backup
   C:\WINDOWS\SYSTEM32\BCMSMI32.exe -> Spyware.UrlSpy : Cleaned with backup
   C:\WINDOWS\SYSTEM32\BO2802040113.dll -> Spyware.BargainBuddy : Cleaned with backup
   C:\WINDOWS\SYSTEM32\BO2804040113.exe -> Spyware.VirtualBouncer : Cleaned with backup
   C:\WINDOWS\SYSTEM32\BO2809040510.exe -> Spyware.VirtualBouncer : Cleaned with backup
   C:\WINDOWS\SYSTEM32\cdfview6.exe -> Spyware.UrlSpy : Cleaned with backup
   C:\WINDOWS\SYSTEM32\cewmdm64.exe -> Spyware.UrlSpy : Cleaned with backup
   C:\WINDOWS\SYSTEM32\eetu.exe -> Spyware.PurityScan : Cleaned with backup
   C:\WINDOWS\SYSTEM32\ezWebRebatesV1.dll -> TrojanDropper.Mudrop.m : Cleaned with backup
   C:\WINDOWS\SYSTEM32\gqtrwe.exe -> Trojan.Agent.gp : Cleaned with backup
   C:\WINDOWS\SYSTEM32\ib1s.dll -> Spyware.BargainBuddy : Cleaned with backup
   C:\WINDOWS\SYSTEM32\MoreResultsSetup.dll -> Spyware.BargainBuddy : Cleaned with backup
   C:\WINDOWS\SYSTEM32\msbb321.dll -> Spyware.BargainBuddy : Cleaned with backup
   C:\WINDOWS\SYSTEM32\pkvyw.dat -> TrojanDownloader.Qoologic.ac : Cleaned with backup
   C:\WINDOWS\SYSTEM32\PSDrvCheck.KO -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\WINDOWS\SYSTEM32\PSDrvCheck.NL -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\WINDOWS\SYSTEM32\PSDrvCheck.NLD -> Spyware.Hijacker.Generic : Cleaned with backup
   C:\WINDOWS\SYSTEM32\SplWbr.dll -> TrojanDropper.Mudrop.m : Cleaned with backup
   C:\WINDOWS\wt\wtupdates\webd\4.1.1\files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
   C:\WINDOWS\wt\wtupdates\wtwebdriver\files\3.3.1.001\npwthost.dll -> Spyware.WildTangent : Cleaned with backup
   C:\WINDOWS\wt\wtupdates\wtwebdriver\files\3.3.1.001\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
   C:\WINDOWS\wt\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
   C:\WINDOWS\zbzszynli.exe -> Adware.BetterInternet : Cleaned with backup

::Report End

physicsforfun · « **Reply #16 on:** August 30, 2005, 09:56:03 AM »

here is the Ewido report as an attachment (I hope, but it seems too big and will not attach) and the hijack and WindPfind separately cut and pasted here.

If this doesn't get througj please tell me what to do to send you this information. Hopefull you can piece together the Ewido reprot from the 2 halves that I sent above...

Here is the attach error:

THE FOLLOWING ERROR(S) WERE FOUND
The total filespace required to upload all the attached files is greater than your per post or global limit. Please reduce the number of attachments or the size of the attachments.

WindPfind:

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
PECompact2 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\lpt$vpn.797
qoologic 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\lpt$vpn.797
SAHAgent 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\lpt$vpn.797
UPX! 5/3/2005 11:44:44 AM 25157 C:\WINDOWS\RMAgentOutput.dll
UPX! 1/10/2005 4:17:24 PM 170053 C:\WINDOWS\tsc.exe
PECompact2 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\VPTNFILE.797
qoologic 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\VPTNFILE.797
SAHAgent 8/23/2005 1:13:02 PM 15666129 C:\WINDOWS\VPTNFILE.797
UPX! 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll
aspack 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll

Checking %System% folder...
UPX! 11/22/2002 11:21:28 AM 123904 C:\WINDOWS\SYSTEM32\avisynth.dll
UPX! 9/17/2001 2:20:02 PM 9216 C:\WINDOWS\SYSTEM32\cpuinf32.dll
69.59.186.63 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
209.66.67.134 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
66.63.167.97 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
66.63.167.77 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
web-nex 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
winsync 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
rec2_run 8/30/2005 2:02:18 AM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
PEC2 8/29/2002 7:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
UPX! 11/24/2001 3:31:48 PM 65536 C:\WINDOWS\SYSTEM32\DVDAudio.ax
UPX! 11/24/2001 3:28:14 PM 86528 C:\WINDOWS\SYSTEM32\DVDVideo.ax
UPX! 2/20/2004 6:49:02 PM 77312 C:\WINDOWS\SYSTEM32\Ia1cm.dll
PTech 7/12/2005 5:50:44 PM 520456 C:\WINDOWS\SYSTEM32\LegitCheckControl.DLL
PECompact2 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2004 3:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 8/4/2004 3:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 8/29/2002 7:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\WBDBASE.DEU
UPX! 8/30/2005 2:05:42 AM 82432 C:\WINDOWS\SYSTEM32\__delete_on_reboot__eetu.exe

Checking %System%\Drivers folder and sub-folders...
PTech 8/4/2004 1:41:38 AM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\ETC\hosts

Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
8/30/2005 2:05:12 AM S 2048 C:\WINDOWS\BOOTSTAT.DAT
7/27/2005 9:43:58 AM H 10820 C:\WINDOWS\Help\update.GID
8/29/2005 11:35:06 PM H 335 C:\WINDOWS\SYSTEM32\vsconfig.xml
7/8/2005 4:23:18 PM S 12143 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB893756.cat
7/19/2005 7:18:10 PM S 18913 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896727.cat
7/2/2005 4:18:16 AM S 9445 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB903235.cat
8/30/2005 3:01:16 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
8/30/2005 2:05:38 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
8/30/2005 2:15:22 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
8/30/2005 3:23:28 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
8/30/2005 3:02:34 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
8/11/2005 3:01:34 AM H 1024 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\NTUSER.DAT.LOG
8/30/2005 2:05:44 AM HS 192 C:\WINDOWS\Tasks\RUTASK.job
8/30/2005 2:05:16 AM H 6 C:\WINDOWS\Tasks\SA.DAT
8/19/2005 12:43:54 PM HS 113 C:\WINDOWS\Temp\History\History.IE5\desktop.ini
8/19/2005 12:43:54 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\1T8AO7D3\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\8DQ78PUJ\desktop.ini
8/19/2005 5:10:16 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\8XUVGXIJ\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\DQF1XA02\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\FACFJXWH\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KL0ZK34V\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KP6ZWT2J\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\KPQZ4PAR\desktop.ini
8/19/2005 5:10:18 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\OHERKTYF\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\QL0BML25\desktop.ini
8/19/2005 5:05:10 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\UMB9DBLF\desktop.ini
8/23/2005 6:01:06 PM HS 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\UPD2RMD8\desktop.ini

Checking for CPL files...
Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Broadcom Corporation 5/8/2003 9:25:18 PM 815104 C:\WINDOWS\SYSTEM32\B57exp.cpl
Broadcom Corporation 6/3/2003 12:38:44 PM 94208 C:\WINDOWS\SYSTEM32\BCMSM.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
FotoNation inc. 3/26/1998 2:01:34 PM 27136 C:\WINDOWS\SYSTEM32\camcpl.cpl
8/23/2005 7:49:04 PM 31232 C:\WINDOWS\SYSTEM32\conres.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Intel Corporation 4/7/2003 2:14:30 AM 94208 C:\WINDOWS\SYSTEM32\igfxcpl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems 12/28/2003 6:43:24 PM 53352 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 8/29/2002 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\MAIN.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Kristal Studio 3/2/2001 10:39:28 PM 121856 C:\WINDOWS\SYSTEM32\Mp3cnfg.cpl
Microsoft Corporation 8/29/2002 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\NCPA.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
Apple Computer, Inc. 4/8/2004 2:12:42 PM 323072 C:\WINDOWS\SYSTEM32\QuickTime.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 8/29/2002 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\TELEPHON.CPL
Microsoft Corporation 8/4/2004 3:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 8/4/2004 3:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\DLLCACHE\wuaucpl.cpl
Intel Corporation 4/7/2003 2:14:30 AM 94208 C:\WINDOWS\SYSTEM32\ReinstallBackups\0000\DriverFiles\igfxcpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
1/20/2004 10:18:02 PM 950 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
9/3/2002 11:00:00 AM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI
1/20/2004 9:00:52 PM 1770 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
5/23/2004 6:15:04 PM 1798 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microtek Scanner Finder.lnk
1/20/2004 9:51:36 PM 782 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ZoneAlarm Pro.lnk

Checking files in %ALLUSERSPROFILE%\Application Data folder...
9/3/2002 10:50:46 AM HS 62 C:\Documents and Settings\All Users\Application Data\DESKTOP.INI

Checking files in %USERPROFILE%\Startup folder...
9/3/2002 11:00:00 AM HS 84 C:\Documents and Settings\Paul\Start Menu\Programs\Startup\DESKTOP.INI

Checking files in %USERPROFILE%\Application Data folder...
9/3/2002 10:50:46 AM HS 62 C:\Documents and Settings\Paul\Application Data\DESKTOP.INI
11/19/2004 11:41:36 AM 61408 C:\Documents and Settings\Paul\Application Data\GDIPFONTCACHEV1.DAT

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
   SV1    =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\fxqkmfgg
   {a10b8124-d9fb-4b39-a065-1ada59a38197}    = C:\WINDOWS\system32\jabke.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\LDVPMenu
   {BDA77241-42F6-11d0-85E2-00AA001FE28C}    = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
   {750fdf0e-2a26-11d1-a3ea-080036587f03}    = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
   {09799AFB-AD67-11d1-ABCD-00C04FC30936}    = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
   {A470F8CF-A1E8-4f65-8335-227475AA5C46}    = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
   Start Menu Pin    = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\LDVPMenu
   {BDA77241-42F6-11d0-85E2-00AA001FE28C}    = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
   {A470F8CF-A1E8-4f65-8335-227475AA5C46}    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
   {750fdf0e-2a26-11d1-a3ea-080036587f03}    = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
   {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}    = ntshrui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
    = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
    = %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
   &Tip of the Day = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
   Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
   MenuText    = Sun Java Console   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45}
   ButtonText    = AIM   : C:\Program Files\AIM\aim.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
   ButtonText    = PartyPoker.com   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
   ButtonText    = Real.com   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E023F504-0C5A-4750-A1E7-A9046DEA8A21}
   ButtonText    = MoneySide   :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
   ButtonText    = Messenger   : C:\Program Files\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
   {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address   : %SystemRoot%\System32\browseui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   IgfxTray   C:\WINDOWS\System32\igfxtray.exe
   HotKeysCmds   C:\WINDOWS\System32\hkcmd.exe
   BCMSMMSG   BCMSMMSG.exe
   dla   C:\WINDOWS\system32\dla\tfswctrl.exe
   StorageGuard   "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
   PCMService   "C:\Program Files\Dell\Media Experience\PCMService.exe"
   TkBellExe   "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
   mmtask   c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
   DwlClient   C:\Program Files\Common Files\Dell\EUSW\Support.exe
   vptray   C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
   HPDJ Taskbar Utility   C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
   HP Component Manager   "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
   HP Software Update   "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
   DeviceDiscovery   C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
   iTunesHelper   C:\Program Files\iTunes\iTunesHelper.exe
   QuickTime Task   "C:\Program Files\QuickTime\qttask.exe" -atboottime
   PinnacleDriverCheck   C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
   NeroFilterCheck   C:\WINDOWS\system32\NeroCheck.exe
   gcasServ   "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
   wdjockb   C:\WINDOWS\system32\ijvahtn.exe r
   System service62   C:\WINDOWS\etb\pokapoka62.exe
   System service63   C:\WINDOWS\etb\pokapoka63.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
   IMAIL   Installed = 1
   MAPI   Installed = 1
   MSFS   Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   Sonic RecordNow!
   MSMSGS   "C:\Program Files\Messenger\msmsgs.exe" /background
   ctfmon.exe   C:\WINDOWS\system32\ctfmon.exe
   PhotoShow Deluxe Media Manager   C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
   {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
   {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
   {0DF44EAA-FF21-4412-828E-260A8728E7F1} =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
   dontdisplaylastusername   0
   legalnoticecaption
   legalnoticetext
   shutdownwithoutlogon   1
   undockwithoutlogon   1

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
   NoDriveTypeAutoRun   145

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
   PostBootReminder    {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
   CDBurn    {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
   WebCheck    {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
   SysTray     {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   UserInit   = C:\WINDOWS\system32\userinit.exe,
   Shell      = Explorer.exe
   System      =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
    = crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
    = cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
    = cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
    = sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
    = WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
    = wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif
    = wzcdlg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
   Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
   AppInit_DLLs

»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.3.1   - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 8/30/2005 3:27:22 AM

Hijack this

Logfile of HijackThis v1.99.1
Scan saved at 9:57:53 AM, on 8/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\azflozd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Paul\Desktop\software stuff\HijackThis adaware etc\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [erbhhuz] C:\WINDOWS\system32\azflozd.exe r
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\lsddsl.exe reg_run
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

guestolo · « **Reply #17 on:** August 30, 2005, 08:16:58 PM »

We still have a bit of work to do

Can you do the following please

I want to make sure you downloaded this tool
Download LQfix.exe and place it on your desktop.
Doubleclick LQfix.exe and click install.
This will create a new folder called LQfix on your desktop.

==Download the Killbox by Option^Explicit. Save to desktop or a folder

Open Notepad (START>>>RUN>>>type in notepad)
Hit OK
Copy the whole contents of the CODE box to notepad, not including the word "code"
In Notepad click FILE>>SAVE AS
IMPORTANT>>>Change the Save as Type to All Files.
Name the file as fix.reg

Save this file on the desktop, well need this later

Code: [Select]

REGEDIT4

[-HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\fxqkmfgg]

[-HKEY_CLASSES_ROOT\CLSID\{a10b8124-d9fb-4b39-a065-1ada59a38197}]

Please Print this out or save these instructions to a Notepad file and save it to your Desktop
Disconnect from the Internet

Double click on fix.reg and allow to add or merge to the registry

Run Killbox.exe.

* Select "Delete on Reboot".

* Copy the file names below to the clipboard by highlighting ALL of them then press CTRL + C

Killbox paths to file names between dotted lines
=======================================

C:\WINDOWS\RMAgentOutput.dll
C:\WINDOWS\system32\azflozd.exe
C:\WINDOWS\system32\jabke.dll
C:\WINDOWS\SYSTEM32\datadx.dll
C:\WINDOWS\SYSTEM32\__delete_on_reboot__eetu.exe
C:\WINDOWS\Tasks\RUTASK.job
C:\WINDOWS\SYSTEM32\conres.cpl
C:\WINDOWS\etb\nt_hide63.dll

==================================================

* Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

* Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. If your computer does not restart automatically, please restart it manually.

Back in Windows stay disconnected from the Internet

Double click on fix.reg again and allow to merge to registry

Do another scan with Hijackthis and put a check next to these entries:

O4 - HKLM\..\Run: [erbhhuz] C:\WINDOWS\system32\azflozd.exe r
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\lsddsl.exe reg_run

After you have ticked the above entries, close All other open windows,
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Open the LQFix folder and doubleclick ClickThis.bat
Follow the prompts on the screen.
Your system will reboot afterwards.
Please be patient after reboot, because there is a script running in the background.

Back in Windows
I need the following, after posting these logs, you must NOT reboot your system again until we have tried another fix or one file will possibly change names

Run another scan with Hijackthis and post a fresh log
Also run WPFind.exe again, when it's done post the new log

physicsforfun · « **Reply #18 on:** August 30, 2005, 09:30:20 PM »

I am in the middle of performing the requested steps and for the Hijackthis step, I do not find the entry

O4 - HKLM\..\Run: [erbhhuz] C:\WINDOWS\system32\azflozd.exe r

However, I do find the entry

O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\system32\Dinst.exe

Which I tried to remove previously...

Should I check the Dinst entry also in Hijackthis prior to performing the "fix checked" step? Or should I just check the one entry that I did find regarding 04-HKLM\....lsddsl.exe reg_run

I will wait to hear from you before proceeding

guestolo · « **Reply #19 on:** August 30, 2005, 09:33:23 PM »

Yes check this entry
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\system32\Dinst.exe

Remember, when you return to Windows
Don't allow Microft Anti-Spyware to interfere with any fixes
If asked for a change ALLOW them

I'll check back later to see how your getting along

News:

Author Topic: malware aurora, trojans, etc (Read 6568 times)

Guest

Guest