The Avira Antivirus Log:
Avira AntiVir Personal
Report file date: Monday, May 26, 2008 11:40
Scanning for 1292849 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: FAMILIAROOM
Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 4/9/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 3/18/2008 17:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 2/7/2008 16:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 2/28/2008 16:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 2/21/2008 16:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 18:33:34
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 3/7/2008 21:08:58
ANTIVIR2.VDF : 7.0.4.53 1848832 Bytes 5/17/2008 17:26:13
ANTIVIR3.VDF : 7.0.4.95 243712 Bytes 5/26/2008 17:26:16
Engineversion : 8.1.0.46
AEVDF.DLL : 8.1.0.5 102772 Bytes 2/25/2008 17:58:21
AESCRIPT.DLL : 8.1.0.33 266618 Bytes 5/26/2008 17:26:34
AESCN.DLL : 8.1.0.18 119156 Bytes 5/26/2008 17:26:32
AERDL.DLL : 8.1.0.20 418165 Bytes 5/26/2008 17:26:31
AEPACK.DLL : 8.1.1.5 364918 Bytes 5/26/2008 17:26:29
AEOFFICE.DLL : 8.1.0.18 192890 Bytes 5/26/2008 17:26:27
AEHEUR.DLL : 8.1.0.29 1253750 Bytes 5/26/2008 17:26:26
AEHELP.DLL : 8.1.0.14 115063 Bytes 5/26/2008 17:26:22
AEGEN.DLL : 8.1.0.21 303477 Bytes 5/26/2008 17:26:21
AEEMU.DLL : 8.1.0.6 430451 Bytes 5/26/2008 17:26:19
AECORE.DLL : 8.1.0.29 168311 Bytes 5/26/2008 17:26:17
AVWINLL.DLL : 1.0.0.7 14593 Bytes 1/24/2008 01:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 2/18/2008 18:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 21:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 1/24/2008 01:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 16:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2/28/2008 16:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/23/2008 01:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 1/24/2008 01:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 20:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 3/10/2008 22:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 3/6/2008 20:02:11
Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: Monday, May 26, 2008 11:40
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'SUPERAntiSpyware.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ALG.EXE' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'IAANTmon.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'LSASS.EXE' - '1' Module(s) have been scanned
Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned
Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned
Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
28 processes with 28 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Starting to scan the registry.
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Start Menu\Programs\Startup\winupdt.exe
[DETECTION] Is the Trojan horse TR/WinlogonHook.C
[NOTE] The file was moved to '48a8f695.qua'!
The registry was scanned ( '22' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Meghan\Application Data\Fοnts\svchost(2).exe
[DETECTION] Is the Trojan horse TR/Dldr.IZP
[NOTE] The file was moved to '489df787.qua'!
C:\Documents and Settings\Meghan\Application Data\Fοnts\svchost.exe
[DETECTION] Is the Trojan horse TR/Spy.Winspool
[NOTE] The file was moved to '489df78a.qua'!
C:\Documents and Settings\Meghan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\java.jar-3197ec81-676f5aa9.zip
--> GetAccess.class
[DETECTION] Contains detection pattern of the Java virus JAVA/OpenConnect.AJ
--> Installer.class
[DETECTION] Contains detection pattern of the Java virus JAVA/OpenConnect.AK
--> NewSecurityClassLoader.class
[DETECTION] Contains detection pattern of the Java virus JAVA/ByteVerify.G.2
--> NewURLClassLoader.class
[DETECTION] Contains detection pattern of the Java virus JAVA/ByteVerify.G.3
[DETECTION] Contains detection pattern of the Java virus JAVA/OpenConnect.AJ
[NOTE] The file was moved to '48b0f79a.qua'!
C:\Documents and Settings\Meghan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3ad601a5-47c9e069.zip
--> vmain.class
[DETECTION] Contains detection pattern of the exploits EXP/Java.Gimsh.B.1
[NOTE] The file was moved to '48a7f7b2.qua'!
C:\Documents and Settings\Meghan\Local Settings\Temporary Internet Files\Content.IE5\Q3SR6XAJ\paramlist[1].htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
[NOTE] The file was moved to '48acf92e.qua'!
C:\Documents and Settings\Zach\Local Settings\Temporary Internet Files\Content.IE5\QIRFR2WM\CA7QMP33.htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
[NOTE] The file was moved to '4871fa7a.qua'!
C:\Documents and Settings\Zach\Local Settings\Temporary Internet Files\Content.IE5\QIRFR2WM\CA8LAR45.htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
[NOTE] The file was moved to '4872fa85.qua'!
C:\Documents and Settings\Zach\Local Settings\Temporary Internet Files\Content.IE5\QIRFR2WM\CAB6AH77.htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
[NOTE] The file was moved to '487cfa88.qua'!
C:\Documents and Settings\Zach\Local Settings\Temporary Internet Files\Content.IE5\QIRFR2WM\CAGXYZG1.htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
[NOTE] The file was moved to '4881fa8b.qua'!
C:\Documents and Settings\Zach\Local Settings\Temporary Internet Files\Content.IE5\QIRFR2WM\CANYOJ3D.htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
[NOTE] The file was moved to '4888fa8d.qua'!
C:\Documents and Settings\Zach\Local Settings\Temporary Internet Files\Content.IE5\QIRFR2WM\CASDAJIF.htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
[NOTE] The file was moved to '488dfa8f.qua'!
C:\Documents and Settings\Zach\Local Settings\Temporary Internet Files\Content.IE5\QIRFR2WM\CASDMJKX.htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
[NOTE] The file was moved to '488dfa92.qua'!
C:\Documents and Settings\Zach\Local Settings\Temporary Internet Files\Content.IE5\QIRFR2WM\CATKWJ9X.htm
[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen
[NOTE] The file was moved to '488efa94.qua'!
C:\My Downloads\the whistle song.rar
--> Setup_toolBar.exe
[DETECTION] Is the Trojan horse TR/Dldr.IstBar.nj
[DETECTION] Is the Trojan horse TR/Dldr.IstBar.nj.1
[NOTE] The file was moved to '489ffbab.qua'!
C:\QooBox\Quarantine\catchme2008-05-25_213513.27.zip
--> bupagfsv.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> cgxshnlr.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> cqynikjo(2).dll
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
--> ecoibhca.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> ewrgqcam.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> hponbbab.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> jnhhgvei.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> llcqfxbe.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> nlummfhg.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> nuogsefg.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> nyaofvsu.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E.1
--> stawxslq.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.D
[NOTE] The file was moved to '48aeff3a.qua'!
C:\QooBox\Quarantine\C\Documents and Settings\Guest\Application Data\CROSOF~1.NET\tracert.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.IZP
[NOTE] The file was moved to '489bff4f.qua'!
C:\QooBox\Quarantine\C\Documents and Settings\Heidrichs\Desktop\WinAntiVirusPro2007FreeInstall.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.WinFixer.Z.2
[NOTE] The file was moved to '48a8ff4a.qua'!
C:\QooBox\Quarantine\C\Documents and Settings\Heidrichs\My Documents\ASKS~1\wuauboot.exe.vir
[DETECTION] Is the Trojan horse TR/Spy.Winspool
[NOTE] The file was moved to '489bff58.qua'!
C:\QooBox\Quarantine\C\Program Files\Common Files\DriveCleaner Free\udcpas.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.WinFixer.E
[NOTE] The file was moved to '489dff4b.qua'!
C:\QooBox\Quarantine\C\Program Files\DriveCleaner Free\UDC6cw.exe.vir
[DETECTION] Is the Trojan horse TR/Fakealert.FB.2
[NOTE] The file was moved to '487dff2d.qua'!
C:\QooBox\Quarantine\C\Program Files\Outerinfo\OiUninstaller.exe.vir
[DETECTION] Contains detection pattern of the dropper DR/PurityScan.FK
[NOTE] The file was moved to '488fff55.qua'!
C:\QooBox\Quarantine\C\Program Files\VSAdd-in\VSAdd-in_1.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.ACL
[NOTE] The file was moved to '487bff41.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ahjrcddj.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '48a4ff59.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\apolbjwv.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48a9ff63.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\bmakubfe.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '489bff62.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\bupagfsv.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48aaff6c.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\cgxshnlr.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48b2ff60.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\cmavpugg.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '489bff68.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\cqdlquof.dll.vir
[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Pcclient.CC Backdoor server programs
[NOTE] The file was moved to '489eff6f.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\cqynikjo(2).dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48b3ff71.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ecoibhca.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48a9ff65.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\epxkflwo.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48b2ff74.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ewrgqcam.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48acff7f.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\eybsoxaa.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '489cff81.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ghfkuufp.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48a0ff71.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ghiaudje.dll.vir
[DETECTION] Is the Trojan horse TR/BHO.G.2
[NOTE] The file was moved to '48a3ff71.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\hponbbab.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48a9ff79.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\hthkulpo.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48a2ff7d.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\icrlispu.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '48acff6d.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ikmmcxdd.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48a7ff75.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\jnhhgvei.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48a2ff78.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\jumrvnja.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48a7ff80.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\jwdesgvt.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '489eff82.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\jxslvyca.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48adff83.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\kuqigkob.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '48abff80.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lhrvtxdj.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48acff74.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lkfpwncu.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48a0ff77.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\llcqfxbe.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '489dff78.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lsnhtnbc.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48a8ff7f.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lwkgdsrq.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '48a5ff84.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lxqhwpkf.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '48abff85.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\mjhnsadh.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48a2ff77.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\mxdpbkva.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '489eff86.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nlummfhg.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48afff7a.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nuogsefg.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '48a9ff83.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nyaofvsu.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '489bff87.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\owejeude.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '489fff86.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\oxcprsrs.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '489dff87.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\pcthkyfd.dll.vir
[DETECTION] Is the Trojan horse TR/Juan.H
[NOTE] The file was moved to '48aeff72.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\pdwpdqrv.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '48b1ff74.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\qvbtpuxn.dll.vir
[DETECTION] Is the Trojan horse TR/BHO.AKY
[NOTE] The file was moved to '489cff86.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rpyadfak.dll.vir
[DETECTION] Is the Trojan horse TR/PSW.Gamania.B
[NOTE] The file was moved to '48b3ff80.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rqwiwnvc.dll.vir
[DETECTION] Is the Trojan horse TR/JuanSearch.B
[NOTE] The file was moved to '48b1ff82.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rvmosebi.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48a7ff87.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\stawxslq.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '489bff85.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\system.exe.vir
[DETECTION] Is the Trojan horse TR/Crypt.d
[NOTE] The file was moved to '48adff8a.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tbdpicev.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '489eff74.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uafkdago.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48a0ff73.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uguirwiw.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '48afff79.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\umtqilca.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '48aeff7f.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uoiqeeeu.dll.vir
[DETECTION] Is the Trojan horse TR/QuerySpy
[NOTE] The file was moved to '48a3ff82.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uqkqjvvn.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '49352055.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uvsdxdka.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48adff89.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vtsqn.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.BQ
[NOTE] The file was moved to '48adff88.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vustxgvt.dll.vir
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '493d205a.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vybiefwf.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '489cff8d.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vyburvca.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '490c205e.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\wdlgbbia.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48a6ff79.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\wkkrgswq.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48a5ff80.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\wopadufe.dll.vir
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '48aaff84.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xaarkfqc.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '489bff76.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xbmddoqf.dll.vir
[DETECTION] Is the Trojan horse TR/Spy.VBStat.H
[NOTE] The file was moved to '48a7ff78.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xcxwxxrf.dll.vir
[DETECTION] Is the Trojan horse TR/BHO.G.2
[NOTE] The file was moved to '48b2ff79.qua'!
C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xdhnmmsd.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '48a2ff7a.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214903.exe
[DETECTION] Contains detection pattern of the dropper DR/PurityScan.FK
[NOTE] The file was moved to '486cffb4.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214922.exe
[DETECTION] Is the Trojan horse TR/Crypt.d
[NOTE] The file was moved to '486cffb5.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214940.dll
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '49e27f96.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214949.dll
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '486cffb6.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214952.dll
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '49e27f97.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214964.dll
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '486cffb8.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214967.dll
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '49e27f99.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214969.dll
[DETECTION] Is the Trojan horse TR/JuanSearch.B
[NOTE] The file was moved to '486cffb7.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214974.dll
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '49e27f98.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214977.dll
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '486cffb9.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214980.dll
[DETECTION] Is the Trojan horse TR/Agent.123952
[NOTE] The file was moved to '49e27f9a.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0214983.dll
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '486cffba.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215025.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '486cffbb.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215026.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '49e27f9c.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215027.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '486cffbd.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215028.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '49e27f9e.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215029.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '49e27f9b.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215030.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '486cffbc.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215031.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '49e27f9d.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215032.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '486cffbf.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215033.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '49e27fe0.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215034.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '486cffc1.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215035.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '49e27fe2.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1076\A0215036.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[NOTE] The file was moved to '486cffbe.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215506.dll
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '486cffce.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215507.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E
[NOTE] The file was moved to '486cffcf.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215508.dll
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '49e27ff0.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215509.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E
[NOTE] The file was moved to '486cffd0.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215510.dll
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '49e27ff1.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215511.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E
[NOTE] The file was moved to '486cffd1.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215512.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E
[NOTE] The file was moved to '49e27ff2.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215513.dll
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '486cffd2.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215514.dll
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[NOTE] The file was moved to '49e27ff3.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215515.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E
[NOTE] The file was moved to '486cffd4.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215516.dll
[DETECTION] Is the Trojan horse TR/Spy.VBStat.E
[NOTE] The file was moved to '486cffd3.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215517.exe
[DETECTION] Contains detection pattern of the dropper DR/Comet.BB.3
[NOTE] The file was moved to '49e27ff4.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215518.exe
[DETECTION] Contains detection pattern of the dropper DR/Toolbar.404Search.H
[NOTE] The file was moved to '486cffd5.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215526.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '49e27ff5.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215527.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '49e27ff6.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215528.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '486cffd7.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215529.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '49e27ff8.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215530.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '486cffd9.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215531.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '486cffd6.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215532.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.3
[NOTE] The file was moved to '49e27ff7.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215534.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '486cffd8.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215535.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS
[NOTE] The file was moved to '49e27ff9.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215537.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '49e27ffa.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215538.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS
[NOTE] The file was moved to '486cffdb.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215539.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '49e27ffc.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215540.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.3
[NOTE] The file was moved to '486cffdd.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215542.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.1
[NOTE] The file was moved to '486cffda.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215543.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '49e27ffb.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215544.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '486cffdc.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215545.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.6
[NOTE] The file was moved to '49e27ffe.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215547.exe
[DETECTION] Is the Trojan horse TR/Adload.MAS.1
[NOTE] The file was moved to '486cffdf.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215548.dll
[DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
[NOTE] The file was moved to '49e27fc0.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215549.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffe1.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215550.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e27ffd.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215551.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffde.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215552.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e27fff.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215553.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486c0020.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215554.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e27fc2.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215555.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffe3.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215556.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e27fc4.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215557.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffe5.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215558.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e28001.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215559.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486c0022.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215560.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e28003.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215561.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486c0024.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215562.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e27fc6.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215563.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffe7.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215564.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e27fc8.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215565.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffe9.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215566.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e28005.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215567.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486c0026.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215568.exe
[DETECTION] Is the Trojan horse TR/Agent.aoy.3
[NOTE] The file was moved to '49e28007.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215569.exe
[DETECTION] Is the Trojan horse TR/Agent.aoy.3
[NOTE] The file was moved to '486c0028.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215570.exe
[DETECTION] Is the Trojan horse TR/Agent.aoy.1
[NOTE] The file was moved to '49e27fca.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215571.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffeb.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215572.exe
[DETECTION] Is the Trojan horse TR/Agent.aoy.3
[NOTE] The file was moved to '49e27fcc.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215573.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffed.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215574.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffe0.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215575.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '49e27fc1.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215576.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[NOTE] The file was moved to '486cffe2.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215579.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '49e27fce.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215587.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '486cffef.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215591.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '49e27fd0.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215592.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '49e27fc3.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215593.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '486cffe4.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215594.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '49e27fc5.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215595.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '486cffe6.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215601.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '486cfff1.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215602.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '49e27fd2.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215608.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '486cfff3.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215611.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '49e27fc7.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215614.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '486cffe8.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215615.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '49e27fc9.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215619.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '486cffea.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215621.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '49e27fd4.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215622.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '486cfff5.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215623.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[NOTE] The file was moved to '49e27fd6.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215624.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cfff7.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215625.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fcb.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215626.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cffec.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215627.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fcd.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215628.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cffee.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215629.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fd8.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215630.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cfff9.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215631.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fda.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215632.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cfffb.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215633.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fcf.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215634.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cfff0.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215635.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fd1.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215636.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cfff2.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215637.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fdc.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215638.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cfffd.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215639.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fde.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215640.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cffff.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215641.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fd3.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215642.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '486cfff4.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215643.exe
[DETECTION] Is the Trojan horse TR/Click.MNB
[NOTE] The file was moved to '49e27fd5.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215644.dll
[DETECTION] Is the Trojan horse TR/BHO.G.3
[NOTE] The file was moved to '486cfff6.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215645.dll
[DETECTION] Is the Trojan horse TR/BHO.G.3
[NOTE] The file was moved to '49e38020.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215646.dll
[DETECTION] Is the Trojan horse TR/Spy.Goldu.FT.1.A
[NOTE] The file was moved to '486d0001.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215647.sys
[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Haxdoor.V.3.A Backdoor server programs
[NOTE] BDS/Haxdoor.V.3.A:[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify//pptp32]
[NOTE] The file was moved to '49e38022.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1078\A0215649.exe
[DETECTION] Is the Trojan horse TR/Click.Agent.NP
[NOTE] The file was moved to '486d0003.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1079\A0218032.dll
[DETECTION] Is the Trojan horse TR/BHO.AKY
[NOTE] The file was moved to '49e38024.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1081\A0218108.exe
[DETECTION] Is the Trojan horse TR/WinlogonHook.C
[NOTE] The file was moved to '486d0009.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1081\A0218109.exe
[DETECTION] Is the Trojan horse TR/Dldr.IZP
[NOTE] The file was moved to '49e3802a.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1081\A0218110.exe
[DETECTION] Is the Trojan horse TR/Spy.Winspool
[NOTE] The file was moved to '486d000b.qua'!
C:\WINDOWS\SYSTEM32\efccbyx.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '489e016d.qua'!
C:\WINDOWS\SYSTEM32\eiliartp.exe
[DETECTION] Is the Trojan horse TR/Agent.AAOA
[NOTE] The file was moved to '48a70170.qua'!
C:\WINDOWS\SYSTEM32\jkkjiij.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48a6017b.qua'!
C:\WINDOWS\SYSTEM32\jkklmnm.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '492b79fc.qua'!
C:\WINDOWS\SYSTEM32\nbspgljm.exe
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48ae017e.qua'!
C:\WINDOWS\SYSTEM32\pptp32.dll
[DETECTION] Is the Trojan horse TR/Spy.Goldu.FT.1.A
[NOTE] The file was moved to '48af0193.qua'!
C:\WINDOWS\SYSTEM32\rqrromm.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48ad0197.qua'!
C:\WINDOWS\SYSTEM32\vtutqrr.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[NOTE] The file was moved to '48b001a4.qua'!
End of the scan: Monday, May 26, 2008 12:29
Used time: 48:12 min
The scan has been done completely.
8187 Scanning directories
201914 Files were scanned
239 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
223 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
201675 Files not concerned
3628 Archives were scanned
2 Warnings
223 Notes
The Combo Fix Log
ComboFix 08-05-25.5 - Heidrichs 2008-05-26 11:32:00.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.281 [GMT -6:00]
Running from: C:\Documents and Settings\Heidrichs\Desktop\ComboFix.exe
* Created a new restore point
[color=\"red\"]
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]
.
((((((((((((((((((((((((( Files Created from 2008-04-26 to 2008-05-26 )))))))))))))))))))))))))))))))
.
2157-07-08 15:36 . 2157-07-08 15:36 3,120 --a------ C:\WINDOWS\MF_C421.lfa
2157-07-08 15:36 . 2157-07-08 15:36 3,120 --a------ C:\WINDOWS\MF_C420.lfa
2008-05-26 11:31 . 2008-05-26 11:31 <DIR> d-------- C:\327882R2FWJFW
2008-05-26 11:31 . 2004-08-04 05:00 388,608 --a------ C:\WINDOWS\SYSTEM32\CF11261.exe
2008-05-26 11:25 . 2008-05-26 11:25 <DIR> d-------- C:\Program Files\Avira
2008-05-26 11:25 . 2008-05-26 11:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-26 03:01 . 2008-05-26 03:01 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-05-26 03:01 . 2008-05-26 03:01 206 --a------ C:\WINDOWS\SYSTEM32\MRT.INI
2008-05-26 00:39 . 2008-05-26 00:39 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-26 00:39 . 2008-05-26 00:39 <DIR> d-------- C:\Documents and Settings\Heidrichs\Application Data\SUPERAntiSpyware.com
2008-05-26 00:39 . 2008-05-26 00:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-26 00:38 . 2008-05-26 00:38 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-26 00:01 . 2008-05-26 00:01 <DIR> d-------- C:\Documents and Settings\Heidrichs\Application Data\Malwarebytes
2008-05-26 00:01 . 2008-05-26 00:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-25 23:17 . 2008-05-25 22:17 449,462 --a------ C:\HaxFix.exe
2008-05-25 21:51 . 2007-07-09 07:09 584,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll
2008-05-24 21:10 . 2008-05-24 21:10 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-23 22:23 . 2008-05-23 22:23 4,286 --a------ C:\WINDOWS\SYSTEM32\Jamster.ico
2008-05-13 05:50 . 2008-05-24 20:18 5,430 --a------ C:\WINDOWS\SYSTEM32\rloci.bin
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 06:34 --------- d-----w C:\Program Files\Common Files\AOL
2008-05-26 06:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-05-26 06:30 --------- d-----w C:\Program Files\WildTangent
2008-05-26 06:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-05-26 06:27 --------- d-----w C:\Program Files\iMesh Applications
2008-05-26 03:03 903,890 --sh--w C:\WINDOWS\Fonts\xfapft.bak1
2008-05-25 03:02 821,289 --sh--w C:\WINDOWS\Fonts\xfapft.bak2
2008-05-12 02:52 --------- d-----w C:\Documents and Settings\Heidrichs\Application Data\Corel
2008-04-23 04:41 0 -c--a-w C:\WINDOWS\Fonts\mcrh.tmp
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\SYSTEM32\msjint40.dll
2008-03-27 08:12 151,583 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\SYSTEM32\win32k.sys
2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys
2007-01-23 01:24 337,290 -c--a-w C:\Documents and Settings\Heidrichs\Application Data\tizupd.bin
2007-01-01 05:00 337,290 -c--a-w C:\Documents and Settings\Guest\Application Data\tizupd.bin
2006-11-14 01:10 337,290 -c--a-w C:\Documents and Settings\Heather\Application Data\tizupd.bin
2005-12-05 05:50 280,064 -c--a-w C:\Documents and Settings\Guest\Application Data\tizhook.bin
2005-09-12 23:19 280,064 -c--a-w C:\Documents and Settings\Heidrichs\Application Data\tizhook.bin
2005-08-19 07:05 280,064 -c--a-w C:\Documents and Settings\Heather\Application Data\tizhook.bin
2006-11-17 02:38 751,332 -csh--w C:\WINDOWS\SYSTEM\apas.bak1
2006-11-23 02:19 765,400 -csh--w C:\WINDOWS\SYSTEM\apas.bak2
.
((((((((((((((((((((((((((((( snapshot_2008-05-26_10.46.26.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-26 06:35:55 16,384 -c--a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
+ 2008-05-26 17:25:33 16,384 -c--a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
- 2008-05-26 06:35:55 32,768 -c--a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-05-26 17:25:33 32,768 -c--a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-01-22 00:12:56 41,792 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys
+ 2008-01-22 00:11:28 22,336 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntmgr.sys
+ 2008-03-04 19:28:53 79,424 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avipbb.sys
+ 2007-03-01 16:34:22 28,352 ----a-w C:\WINDOWS\
