rmurphy Posted November 15, 2007 Report Share Posted November 15, 2007 Hi, I'm Ryan, and I'll be helping you from here, cuz MoNsTeReNeRgY22 is leaving for vacation (lucky dog).How is the computer running?Can you please scan with combofix again, and post the log from that, as well as a new HiJackThis log, and I'll take a look at what needs to be done from there.-Ryan Link to post Share on other sites
DaDooDaidy Posted November 15, 2007 Author Report Share Posted November 15, 2007 (edited) The computer is running okay, but is not totally normal. There is no list after All Programs in the start menu, there is no recycle bin and the modem is not functioning. If I type an incorrect url in the Mozilla Firefox browser, it will seem to hang with a connection dialog and then nothing works until the browser is closed and started again. When I print a document, I get a Windows Installer dialog that I have to cancel and close, but it still prints.The ComboFix did not restart the computer this time, so I hope it means we're making progress.ComboFix.txtComboFix 07-11-08.1 - Toomay Technologies 2007-11-14 20:39:07.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.490 [GMT -8:00]Running from: C:\Documents and Settings\Toomay Technologies\Desktop\ComboFix.exe.((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 ))))))))))))))))))))))))))))))).2007-11-12 19:37 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan2007-11-11 11:38 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab2007-11-11 11:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab2007-11-10 12:27 51,200 --a------ C:\WINDOWS\NirCmd.exe2007-11-10 11:35 <DIR> d-------- C:\Deckard2007-11-07 21:01 <DIR> d-------- C:\HJT2007-11-07 19:58 <DIR> d-------- C:\Documents and Settings\Toomay Technologies\Application Data\Lavasoft2007-11-07 19:57 <DIR> d-------- C:\Program Files\Lavasoft2007-11-07 17:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy2007-11-07 14:36 <DIR> d--hs---- C:\GA6P2007-11-07 14:30 8,704 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll2007-11-07 12:47 <DIR> d-------- C:\Program Files\InCode Solutions2007-11-07 10:29 <DIR> d-------- C:\Program Files\NoAdware5.02007-11-07 07:17 128,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmgr.sys2007-11-07 07:17 23,040 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmc.exe2007-11-07 07:17 16,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltlib.dll2007-11-07 07:07 <DIR> d-------- C:\Program Files\MSXML 4.02007-11-06 22:22 584,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll2007-11-06 21:39 271,224 --a------ C:\WINDOWS\SYSTEM32\mucltui.dll2007-11-06 21:25 22,112 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\COH_Mon.sys2007-10-30 19:55 625,032 --a------ C:\WINDOWS\SYSTEM32\SymNeti.dll2007-10-30 19:55 242,056 --a------ C:\WINDOWS\SYSTEM32\SymRedir.dll2007-10-30 19:55 191,536 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symtdi.sys2007-10-30 19:55 145,968 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symfw.sys2007-10-30 19:55 39,856 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symids.sys2007-10-30 19:55 37,936 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symndisv.sys2007-10-30 19:55 35,120 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symndis.sys2007-10-30 19:55 27,696 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symredrv.sys2007-10-30 19:55 12,848 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symdns.sys.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2007-11-15 01:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared2007-11-15 01:10 --------- d-----w C:\Documents and Settings\Toomay Technologies\Application Data\MSN62007-11-13 04:01 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec2007-11-10 22:44 --------- d-----w C:\Program Files\Sagekey Software2007-11-07 05:20 --------- d-----w C:\Program Files\Symantec2007-11-07 05:19 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF2007-11-07 05:19 60,800 ----a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL2007-11-07 05:19 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS2007-11-07 05:19 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT2007-10-31 03:24 12,963 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat2007-10-31 03:24 1,358 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf2007-09-18 22:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat2007-09-18 22:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat2007-09-18 22:44 10,658 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat2007-09-18 22:44 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf2007-09-18 22:44 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf2007-09-18 22:44 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf2007-09-18 22:43 43,696 ----a-w C:\WINDOWS\system32\drivers\srtspx.sys2007-09-18 22:43 317,616 ----a-w C:\WINDOWS\system32\drivers\srtspl.sys2007-09-18 22:43 278,576 ----a-w C:\WINDOWS\system32\drivers\srtsp.sys2007-08-22 13:12 96,256 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll2007-08-22 13:12 658,944 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll2007-08-22 13:12 615,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll2007-08-22 13:12 55,808 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll2007-08-22 13:12 532,480 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll2007-08-22 13:12 474,112 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll2007-08-22 13:12 449,024 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll2007-08-22 13:12 39,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll2007-08-22 13:12 357,888 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll2007-08-22 13:12 3,058,176 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll2007-08-22 13:12 251,392 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll2007-08-22 13:12 205,312 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll2007-08-22 13:12 16,384 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll2007-08-22 13:12 151,040 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll2007-08-22 13:12 146,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll2007-08-22 13:12 1,494,528 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll2007-08-22 13:12 1,054,208 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll2007-08-22 13:12 1,022,976 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll2007-08-21 10:30 18,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll2007-08-21 06:15 683,520 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll.((((((((((((((((((((((((((((( snapshot@2007-11-10_12.41.46.23 ))))))))))))))))))))))))))))))))))))))))).+ 2006-08-24 16:28:54 141,424 ----a-w C:\WINDOWS\Downloaded Program Files\asinst.dll+ 2007-03-29 17:20:50 110,592 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\as.dll+ 2006-10-06 00:15:26 233,472 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\ascontrol.dll+ 2005-06-03 22:03:18 96,256 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\asmdat.dll+ 2003-08-01 19:00:16 36,864 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\certdll.dll+ 2005-05-20 21:42:44 86,016 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\instlsp.dll+ 2006-02-17 02:20:20 4,608 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\memvfile.dll+ 2005-10-26 02:08:32 348,160 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\msvcr71.dll+ 2004-05-04 23:01:02 139,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavaleas.dll+ 2006-07-14 21:04:10 45,056 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavdr.exe+ 2006-04-10 18:50:02 159,832 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavexcom.dll+ 2006-02-14 21:05:38 94,208 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavinas.dll+ 2006-02-17 02:35:38 180,224 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavoe.dll+ 2006-10-06 00:15:38 122,880 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavpz.dll+ 2006-06-30 22:13:38 8,704 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pfdnnt.exe+ 2004-02-04 22:08:42 49,152 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\port32.dll+ 2006-08-01 21:23:10 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pscpu.dll+ 2006-08-23 21:06:08 1,388,544 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskahk.dll+ 2006-08-17 19:38:14 10,752 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskalloc.dll+ 2006-09-04 19:49:54 61,440 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskas.dll+ 2006-08-18 16:46:18 779,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskavs.dll+ 2007-03-26 22:25:34 417,792 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskcmp.dll+ 2006-08-09 18:42:24 90,112 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskfss.dll+ 2006-07-19 18:55:58 208,896 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskhtml.dll+ 2006-01-21 00:57:00 9,728 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmas.dll+ 2006-05-17 17:50:12 14,336 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmdfs.dll+ 2006-08-16 18:58:12 33,280 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskpack.dll+ 2006-06-30 22:42:36 266,240 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskscs.dll+ 2006-08-17 22:33:14 62,976 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskutil.dll+ 2006-08-08 21:13:10 13,312 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfile.dll+ 2006-08-18 16:53:08 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfs.dll+ 2006-08-18 16:49:50 167,936 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvm.dll+ 2007-04-19 01:16:04 353,840 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psscan.dll+ 2007-01-22 22:42:48 35,328 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\rawvfile.dll+ 1997-09-18 14:12:32 9,488 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\sporder.dll+ 2006-03-01 01:23:40 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\tcpvfile.dll+ 2006-08-02 20:39:06 73,728 ----a-w C:\WINDOWS\SYSTEM32\asuninst.exe+ 2005-05-24 20:27:16 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll+ 2007-08-29 23:47:20 94,208 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe+ 2007-08-29 23:49:54 950,272 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll+ 2003-03-26 02:53:50 11,776 ----a-w C:\WINDOWS\SYSTEM32\ZPORT4AS.dll.-- Snapshot reset to current date --.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C1DD717-53B2-485E-A17B-C9977C205E10}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF4535AA-6BBA-4B92-9F85-7A5488F03926}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2FB8A5C-CEC8-4E21-93F3-FF0CE1331C86}][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 09:19]"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 21:59][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24]"LDM"="D:\Apps\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" []"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]"RemoveIT Pro v4Ent"="C:\Program Files\InCode Solutions\RemoveIT Pro v4\removeit.exe" [2007-11-07 15:28][HKEY_USERS\.default\software\microsoft\windows\currentversion\run]"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exeR2 ASFAgent;ASF Agent;C:\Program Files\Intel\ASF Agent\ASFAgent.exeR2 AsfAlrt;AsfAlrt;\??\C:\WINDOWS\System32\drivers\AsfAlrt.sysS3 HPFXBULK;HPFXBULK;C:\WINDOWS\system32\drivers\hpfxbulk.sys*Newly Created Service* - COMHOST.Contents of the 'Scheduled Tasks' folder"2007-11-13 04:00:48 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Toomay Technologies.job"- D:\Apps\NortonAV7\Norton AntiVirus\Navw32.exe.**************************************************************************catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2007-11-14 20:41:26Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... **************************************************************************.Completion time: 2007-11-14 20:42:40C:\ComboFix2.txt ... 2007-11-11 10:50C:\ComboFix3.txt ... 2007-11-10 12:43. --- E O F ---Hijackthis Log.txtComboFix 07-11-08.1 - Toomay Technologies 2007-11-14 20:39:07.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.490 [GMT -8:00]Running from: C:\Documents and Settings\Toomay Technologies\Desktop\ComboFix.exe.((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 ))))))))))))))))))))))))))))))).2007-11-12 19:37 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan2007-11-11 11:38 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab2007-11-11 11:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab2007-11-10 12:27 51,200 --a------ C:\WINDOWS\NirCmd.exe2007-11-10 11:35 <DIR> d-------- C:\Deckard2007-11-07 21:01 <DIR> d-------- C:\HJT2007-11-07 19:58 <DIR> d-------- C:\Documents and Settings\Toomay Technologies\Application Data\Lavasoft2007-11-07 19:57 <DIR> d-------- C:\Program Files\Lavasoft2007-11-07 17:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy2007-11-07 14:36 <DIR> d--hs---- C:\GA6P2007-11-07 14:30 8,704 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll2007-11-07 12:47 <DIR> d-------- C:\Program Files\InCode Solutions2007-11-07 10:29 <DIR> d-------- C:\Program Files\NoAdware5.02007-11-07 07:17 128,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmgr.sys2007-11-07 07:17 23,040 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmc.exe2007-11-07 07:17 16,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltlib.dll2007-11-07 07:07 <DIR> d-------- C:\Program Files\MSXML 4.02007-11-06 22:22 584,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll2007-11-06 21:39 271,224 --a------ C:\WINDOWS\SYSTEM32\mucltui.dll2007-11-06 21:25 22,112 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\COH_Mon.sys2007-10-30 19:55 625,032 --a------ C:\WINDOWS\SYSTEM32\SymNeti.dll2007-10-30 19:55 242,056 --a------ C:\WINDOWS\SYSTEM32\SymRedir.dll2007-10-30 19:55 191,536 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symtdi.sys2007-10-30 19:55 145,968 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symfw.sys2007-10-30 19:55 39,856 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symids.sys2007-10-30 19:55 37,936 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symndisv.sys2007-10-30 19:55 35,120 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symndis.sys2007-10-30 19:55 27,696 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symredrv.sys2007-10-30 19:55 12,848 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symdns.sys.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2007-11-15 01:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared2007-11-15 01:10 --------- d-----w C:\Documents and Settings\Toomay Technologies\Application Data\MSN62007-11-13 04:01 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec2007-11-10 22:44 --------- d-----w C:\Program Files\Sagekey Software2007-11-07 05:20 --------- d-----w C:\Program Files\Symantec2007-11-07 05:19 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF2007-11-07 05:19 60,800 ----a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL2007-11-07 05:19 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS2007-11-07 05:19 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT2007-10-31 03:24 12,963 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat2007-10-31 03:24 1,358 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf2007-09-18 22:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat2007-09-18 22:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat2007-09-18 22:44 10,658 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat2007-09-18 22:44 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf2007-09-18 22:44 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf2007-09-18 22:44 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf2007-09-18 22:43 43,696 ----a-w C:\WINDOWS\system32\drivers\srtspx.sys2007-09-18 22:43 317,616 ----a-w C:\WINDOWS\system32\drivers\srtspl.sys2007-09-18 22:43 278,576 ----a-w C:\WINDOWS\system32\drivers\srtsp.sys2007-08-22 13:12 96,256 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll2007-08-22 13:12 658,944 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll2007-08-22 13:12 615,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll2007-08-22 13:12 55,808 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll2007-08-22 13:12 532,480 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll2007-08-22 13:12 474,112 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll2007-08-22 13:12 449,024 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll2007-08-22 13:12 39,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll2007-08-22 13:12 357,888 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll2007-08-22 13:12 3,058,176 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll2007-08-22 13:12 251,392 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll2007-08-22 13:12 205,312 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll2007-08-22 13:12 16,384 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll2007-08-22 13:12 151,040 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll2007-08-22 13:12 146,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll2007-08-22 13:12 1,494,528 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll2007-08-22 13:12 1,054,208 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll2007-08-22 13:12 1,022,976 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll2007-08-21 10:30 18,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll2007-08-21 06:15 683,520 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll.((((((((((((((((((((((((((((( snapshot@2007-11-10_12.41.46.23 ))))))))))))))))))))))))))))))))))))))))).+ 2006-08-24 16:28:54 141,424 ----a-w C:\WINDOWS\Downloaded Program Files\asinst.dll+ 2007-03-29 17:20:50 110,592 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\as.dll+ 2006-10-06 00:15:26 233,472 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\ascontrol.dll+ 2005-06-03 22:03:18 96,256 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\asmdat.dll+ 2003-08-01 19:00:16 36,864 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\certdll.dll+ 2005-05-20 21:42:44 86,016 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\instlsp.dll+ 2006-02-17 02:20:20 4,608 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\memvfile.dll+ 2005-10-26 02:08:32 348,160 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\msvcr71.dll+ 2004-05-04 23:01:02 139,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavaleas.dll+ 2006-07-14 21:04:10 45,056 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavdr.exe+ 2006-04-10 18:50:02 159,832 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavexcom.dll+ 2006-02-14 21:05:38 94,208 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavinas.dll+ 2006-02-17 02:35:38 180,224 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavoe.dll+ 2006-10-06 00:15:38 122,880 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavpz.dll+ 2006-06-30 22:13:38 8,704 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pfdnnt.exe+ 2004-02-04 22:08:42 49,152 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\port32.dll+ 2006-08-01 21:23:10 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pscpu.dll+ 2006-08-23 21:06:08 1,388,544 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskahk.dll+ 2006-08-17 19:38:14 10,752 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskalloc.dll+ 2006-09-04 19:49:54 61,440 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskas.dll+ 2006-08-18 16:46:18 779,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskavs.dll+ 2007-03-26 22:25:34 417,792 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskcmp.dll+ 2006-08-09 18:42:24 90,112 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskfss.dll+ 2006-07-19 18:55:58 208,896 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskhtml.dll+ 2006-01-21 00:57:00 9,728 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmas.dll+ 2006-05-17 17:50:12 14,336 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmdfs.dll+ 2006-08-16 18:58:12 33,280 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskpack.dll+ 2006-06-30 22:42:36 266,240 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskscs.dll+ 2006-08-17 22:33:14 62,976 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskutil.dll+ 2006-08-08 21:13:10 13,312 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfile.dll+ 2006-08-18 16:53:08 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfs.dll+ 2006-08-18 16:49:50 167,936 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvm.dll+ 2007-04-19 01:16:04 353,840 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psscan.dll+ 2007-01-22 22:42:48 35,328 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\rawvfile.dll+ 1997-09-18 14:12:32 9,488 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\sporder.dll+ 2006-03-01 01:23:40 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\tcpvfile.dll+ 2006-08-02 20:39:06 73,728 ----a-w C:\WINDOWS\SYSTEM32\asuninst.exe+ 2005-05-24 20:27:16 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll+ 2007-08-29 23:47:20 94,208 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe+ 2007-08-29 23:49:54 950,272 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll+ 2003-03-26 02:53:50 11,776 ----a-w C:\WINDOWS\SYSTEM32\ZPORT4AS.dll.-- Snapshot reset to current date --.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C1DD717-53B2-485E-A17B-C9977C205E10}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF4535AA-6BBA-4B92-9F85-7A5488F03926}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2FB8A5C-CEC8-4E21-93F3-FF0CE1331C86}][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 09:19]"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 21:59][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24]"LDM"="D:\Apps\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" []"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]"RemoveIT Pro v4Ent"="C:\Program Files\InCode Solutions\RemoveIT Pro v4\removeit.exe" [2007-11-07 15:28][HKEY_USERS\.default\software\microsoft\windows\currentversion\run]"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exeR2 ASFAgent;ASF Agent;C:\Program Files\Intel\ASF Agent\ASFAgent.exeR2 AsfAlrt;AsfAlrt;\??\C:\WINDOWS\System32\drivers\AsfAlrt.sysS3 HPFXBULK;HPFXBULK;C:\WINDOWS\system32\drivers\hpfxbulk.sys*Newly Created Service* - COMHOST.Contents of the 'Scheduled Tasks' folder"2007-11-13 04:00:48 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Toomay Technologies.job"- D:\Apps\NortonAV7\Norton AntiVirus\Navw32.exe.**************************************************************************catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2007-11-14 20:41:26Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... **************************************************************************.Completion time: 2007-11-14 20:42:40C:\ComboFix2.txt ... 2007-11-11 10:50C:\ComboFix3.txt ... 2007-11-10 12:43. --- E O F --- Edited November 15, 2007 by DaDooDaidy Link to post Share on other sites
rmurphy Posted November 15, 2007 Report Share Posted November 15, 2007 Download GMER from here:http://www.gmer.net/files.phpUnzip it to the desktop.Open the program and click on the Rootkit tab.Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.Click on Scan.When the scan has run click Copy and paste the results (if any) into this thread. Link to post Share on other sites
DaDooDaidy Posted November 15, 2007 Author Report Share Posted November 15, 2007 (edited) I saved gmer.zip and then extracted gmer.exe to the desktop with WinZip. It won't stay open long enough to do anything else.Update! I right clicked it and did Open As. Now it's open. Edited November 15, 2007 by DaDooDaidy Link to post Share on other sites
DaDooDaidy Posted November 15, 2007 Author Report Share Posted November 15, 2007 (edited) The file is too big too post all of it at once. I just tried posting a portion of it here and it didn't show up. Can I attach the file here or email it to you?I have to sign off tonight, but I will check back in the morning. Edited November 15, 2007 by DaDooDaidy Link to post Share on other sites
DaDooDaidy Posted November 15, 2007 Author Report Share Posted November 15, 2007 When I shut down the computer last night, I got a strange option to update and shutdown. I know I didn't do anything new, so I changed it to shutdown only. I also unplugged the modem wire since it's not working right now. I am attaching a zip file of the Gmer text to this post.gmer_text.zip Link to post Share on other sites
rmurphy Posted November 16, 2007 Report Share Posted November 16, 2007 == Clear Temporary Files ==Please download ATF Cleaner by Atribune.This program is for XP and Windows 2000 onlyClose all Internet Explorer, Firefox, and Opera windows before continuing.Double-click ATF-Cleaner.exe to run the program.Under Main choose: Select AllClick the Empty Selected button.If you use Firefox browserClick Firefox at the top and choose: Select AllClick the Empty Selected button.NOTE: If you would like to keep your saved passwords, please click No at the prompt.If you use Opera browserClick Opera at the top and choose: Select AllClick the Empty Selected button.NOTE: If you would like to keep your saved passwords, please click No at the prompt.Click Exit on the Main menu to close the program.For Technical Support, double-click the e-mail address located at the bottom of each menu.== Kaspersky Web Scanner ==Please do an online scan with Kaspersky WebScanner You will need to use Internet Explorer to do thisClick on Kaspersky Online ScannerYou will be promted to install an ActiveX component from Kaspersky, Click Yes.The program will launch and then begin downloading the latest definition files:Once the files have been downloaded click on NEXTNow click on Scan SettingsIn the scan settings make that the following are selected:Scan using the following Anti-Virus database:Extended (if available otherwise Standard)Scan Options:Scan ArchivesScan Mail Bases[*]Click OK[*]Now under select a target to scan:Select My Computer[*]This will program will start and scan your system.[*]The scan will take a while so be patient and let it run.[*]Once the scan is complete it will display if your system has been infected.Now click on the Save as Text button:[*]Save the file to your desktop.== Request Logs ==Please post the log from the Kaspersky scan.-Ryan Link to post Share on other sites
DaDooDaidy Posted November 16, 2007 Author Report Share Posted November 16, 2007 (edited) When I did the ATF cleaner, there was no option for FireFox or Opera. I'm using FireFox and I have no passwords stored anyway. It still seemed to work, because it cleaned 30,691 MBs.Then I did the Kaspersky scan. Is it getting better? I don't know most of those email addresses. It was from a list server group. Someone went on vacation once and the auto reply message probably kept sending out a virus. Yikes! Kaspersky results...------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, November 16, 2007 7:35:12 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 16/11/2007 Kaspersky Anti-Virus database records: 460197-------------------------------------------------------------------------------Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: trueScan Target - My Computer: A:\ C:\ D:\ E:\ F:\ J:\ Z:\Scan Statistics: Total number of scanned objects: 111223 Number of viruses found: 18 Number of infected objects: 264 Number of suspicious objects: 0 Duration of the scan process: 08:39:22Infected Object Name / Virus Name / Last ActionC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-11-15_Log.ALUSchedulerSvc.LiveUpdate Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\index.qbs Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\59DCE333.TMP Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skippedC:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skippedC:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skippedC:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skippedC:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\abook.mab Object is locked skippedC:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\Cache\_CACHE_001_ Object is locked skippedC:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\Cache\_CACHE_002_ Object is locked skippedC:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\Cache\_CACHE_003_ Object is locked skippedC:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\Cache\_CACHE_MAP_ Object is locked skippedC:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\panacea.dat Object is locked skippedC:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\parent.lock Object is locked skippedC:\Documents and Settings\Toomay Technologies\Cookies\INDEX.DAT Object is locked skippedC:\Documents and Settings\Toomay Technologies\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skippedC:\Documents and Settings\Toomay Technologies\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skippedC:\Documents and Settings\Toomay Technologies\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skippedC:\Documents and Settings\Toomay Technologies\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\Toomay Technologies\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\Toomay Technologies\Local Settings\History\History.IE5\INDEX.DAT Object is locked skippedC:\Documents and Settings\Toomay Technologies\Local Settings\History\History.IE5\MSHist012007111520071116\index.dat Object is locked skippedC:\Documents and Settings\Toomay Technologies\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skippedC:\Documents and Settings\Toomay Technologies\NTUSER.DAT Object is locked skippedC:\Documents and Settings\Toomay Technologies\ntuser.dat.LOG Object is locked skippedC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skippedC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll Object is locked skippedC:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skippedC:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skippedC:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skippedC:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skippedC:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skippedC:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skippedC:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skippedC:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092861.old Infected: not-a-virus:FraudTool.Win32.BestSeller.a skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092862.old Infected: not-a-virus:FraudTool.Win32.BestSeller.a skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092871.old Infected: not-a-virus:FraudTool.Win32.BestSeller.a skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092904.exe Infected: not-a-virus:FraudTool.Win32.BestSeller.a skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092905.sys Infected: not-a-virus:FraudTool.Win32.BestSeller.a skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092906.sys Infected: not-a-virus:FraudTool.Win32.BestSeller.a skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092907.dll Infected: not-a-virus:FraudTool.Win32.BestSeller.a skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092955.exe Infected: not-a-virus:Downloader.Win32.WinFixer.at skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092992.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093004.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093007.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093115.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ahr skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093116.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093120.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ahr skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0070.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0071.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0073.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0074.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe WiseSFX: infected - 11 skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe WiseSFX Dropper: infected - 11 skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0084.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0084.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0084.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0087.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0087.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0087.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0088.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0090.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0091.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.i skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe WiseSFX: infected - 16 skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe WiseSFX Dropper: infected - 16 skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0105525.exe Infected: not-a-virus:Downloader.Win32.WinFixer.au skippedC:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\change.log Object is locked skippedC:\WINDOWS\Debug\PASSWD.LOG Object is locked skippedC:\WINDOWS\SchedLgU.Txt Object is locked skippedC:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skippedC:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skippedC:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skippedC:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skippedC:\WINDOWS\SYSTEM32\HPPDEVX.DLL.log Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skippedC:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skippedC:\WINDOWS\Temp\T30DebugLogFile.txt Object is locked skippedC:\WINDOWS\WindowsUpdate.log Object is locked skippedD:\Apps\NortonAV7\Norton AntiVirus\AVApp.log Object is locked skippedD:\Apps\NortonAV7\Norton AntiVirus\AVError.log Object is locked skippedD:\Apps\NortonAV7\Norton AntiVirus\AVVirus.log Object is locked skippedD:\Apps\timbuktupro\Activity.log Object is locked skippedD:\Apps\timbuktupro\Personal.tbk Object is locked skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F ... /[From "Pearl Meade" <[email protected]>][Date Wed, 11 May 2005 15:10:19 +0500]/html Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . . ... ... /[From "Tom Plummer" <[email protected]>][Date Tue, 10 May 2005 13:36:10 -0500]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . . ... /[From "Bianca Francis" <[email protected]>][Date Fri, 06 May 2005 17:14:25 -0500]/html Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . ... /[Fr ... /[From Tim Toomay <[email protected]>][Date Thu, 05 May 2005 11:14:56 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . ... /[From ... /[From "Douglas Webb" <[email protected]>][Date Thu, 5 May 2005 12:26:22 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . ... /[From ... /[From Dora Camacho <[email protected]>][Date Wed, 04 May 2005 21:38:42 +0200]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . ... /[From "Wilmer Bergeron" <[email protected]>][Date Wed, 04 May 2005 07:45:47 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F ... /[From "claribel isene" <[email protected]>][Date Tue, 3 May 2005 04:44:10 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[Fro ... /[From "Anahi Santiago" <[email protected]>][Date Tue, 03 May 2005 16:49:35 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[From "Gregorio Olsen" <[email protected]>][Date Mon, 02 May 2005 19:52:42 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:1 ... /[From "SunTrust Bank, Inc." <[email protected]>][Date Wed, 06 Sep 2006 11:58:38 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.qb skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAME ... /[From "Gas Station Critics" <[email protected]>][Date Wed, 6 Sep 2006 12:56:23 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.qb skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[ ... / ... /[From "zeidemik.com" <[email protected]>][Date Wed, 6 Sep 2006 12:43:40 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.qb skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[ ... /[From Wine Connoisseurs<[email protected]>][Date 06 Sep 2006 12:37:47 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.qb skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08 ... /[From "Branch Banking and Trust" <[email protected]>][Date Mon, 19 Mar 2007 22:35:25 -0400 ( ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08 ... /[From "Branch Banking and Trust" <[email protected]>][Date Mon, 19 Mar 2007 22:35:25 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[F ... /[From "Zpmill tutelage" <[email protected]>][Date Mon, 19 Mar 2007 22:12:25 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[F ... /[ . ... /[From Thomas S. Nolan <[email protected]>][Date Tue, 20 Mar 2007 10:11:34 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[F ... /[ ... /[From artyku" <[email protected]>][Date 20 Mar 2007 03:13:01 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[F ... /[From "Lila Milligan" <[email protected]>][Date Mon, 19 Mar 2007 21:55:08 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[From "123 ... /[From "Ryan" <[email protected]>][Date Mon, 19 Mar 2007 20:22:22 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[From "123Inkjets" <[email protected]>][Date Mon, 19 Mar 2007 17:31:54 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... /[F ... /[From "Rqeccles field" <[email protected]>][Date Wed, 14 Feb 2007 05:25:05 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... /[From "Lncommandeer corrode" <[email protected]>][Date Mon, 19 Mar 2007 15:24:44 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From ... /[Fro ... /[From "Bidz" <[email protected]>][Date Mon, 19 Mar 2007 17:06:25 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From ... /[From Anita Holley <[email protected]>][Date Mon, 19 Mar 2007 21:13:32 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From "Warran ... /[From "Buddy" <[email protected]>][Date Tue, 20 Mar 2007 06:53:11 + ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From "Warran ... /[From "Buddy" <[email protected]>][Date Tue, 20 Mar 2007 06:53:11 +1100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From "WarrantyOptio ... /[From trim <[email protected]>][Date Mon, 19 Mar 2007 20:51:46 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From "WarrantyOptions" <[email protected]>][Date Mon, 19 Mar 2007 10:11:50 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "WarrantyOptions" <[email protected]>][Date Mon, 19 Mar 2007 08:31:38 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... ... /[From "Foreman" <[email protected]>][Date Mon, 19 Mar 2007 08:07:33 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[F ... ... /[From "Stephen" <[email protected]>][Date Mon, 19 Mar 2007 11:30:02 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[F ... /[From Barber P. Susan <[email protected]>][Date Mon, 19 Mar 2007 10:51:59 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "Fredrick ... /[From Media" <[email protected]>][Date 19 Mar 2007 10:45:38 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "Fredrick Gipson" <[email protected]>][Date Mon, 19 Mar 2007 08:10:39 - ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "Fredrick Gipson" <[email protected]>][Date Mon, 19 Mar 2007 08:10:39 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou . ... /[From Carol Harrington <[email protected]>][Date Mon, 19 Mar 2007 15:43:45 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou . ... /[From "Eloise Wilder" <[email protected]>][Date Sun, 18 Mar 2007 23:11:24 -050 ... /html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou . ... /[From "Eloise Wilder" <[email protected]>][Date Sun, 18 Mar 2007 23:11:24 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From Baby Offers<[email protected]>][Date 18 Mar 2007 21:59:47 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... / ... /[From Page I. Jean <[email protected]>][Date Mon, 19 Mar 2007 11:23:06 +0900]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "123Inkjets" <[email protected]>][Date Sun, 18 Mar 2007 17:34:05 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... ... ... /[From Reynold D. Hollis <[email protected]>][Date Sun, 18 Mar 2007 16:29:39 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... ... /[From Deon S. Justice <[email protected]>][Date Sun, 18 Mar 2007 14:15:10 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[Fr ... /[From "Darell" <[email protected]>][Date Mon, 19 Mar 2007 06:22:25 +1100]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "123Inkjets" <[email protected]>][Date Sun, 18 Mar 2007 15:21:18 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Touch Can O ... /[From "Wayne Haney" <[email protected]>][Date Sun, 18 Mar 2007 13:51:58 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Touch Can Opener" <[email protected]>][Date Sun, 18 Mar 2007 11:31:21 -0600]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "CleverClasp" <[email protected]>][Date Sun, 18 Mar 2007 09:21:25 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[Fro ... /[From Robert A.<[email protected]>][Date 18 Mar 2007 07:13:37 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "DebttoWeal ... /[From [email protected]][Date 9 Mar 2007 23:44:46 +0100]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "DebttoWealth" <Debt ... /[From Talk" <[email protected]>][Date 17 Mar 2007 21:08:46 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "DebttoWealth" <[email protected]>][Date Sat, 17 Mar 2007 19:58:11 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... .. ... /[From "123Inkjets" <[email protected]>][Date Sat, 17 Mar 2007 17:28:56 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... .. ... /[From "CECILIA MCBRIDE" <[email protected]>][Date Sat, 17 Mar 2007 14:03:07 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[F ... /[From Funk Unlimited <[email protected]>][Date 17 Mar 2007 15:03:49 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "Radius Group" <[email protected]>][Date Sat, 17 Mar 2007 14:54:30 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[Fro ... /[From "DoggySteps" <[email protected]>][Date Sat, 17 Mar 2007 13:28:44 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "Extreme Make ... /[From payable <[email protected]>][Date Sat, 17 Mar 2007 18:27:48 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "Extreme Makeover" ... /[From walk" <[email protected]>][Date 17 Mar 2007 17:25:34 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "Extreme Makeover" <[email protected]>][Date Sat, 17 Mar 2007 07:45:32 -0500 (GMT-05:00)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[Fr ... / ... /[From "eBay" <[email protected]>][Date Sat, 17 Mar 2007 04:33:34 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[Fr ... / ... /[From Gary <[email protected]>][Date Sat, 17 Mar 2007 14:56:36 +0530]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[Fr ... /[From "4Seasons" <[email protected]>][Date Sat, 17 Mar 2007 02:56:27 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From [email protected] <[email protected]>][Date 16 Mar 2007 21:16:32 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... / ... /[From "Jewel Hart" <[email protected]>][Date Sat, 17 Mar 2007 02:43:58 + ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... / ... /[From "Jewel Hart" <[email protected]>][Date Sat, 17 Mar 2007 02:43:58 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "ink ... /[From "Bidz" <[email protected]>][Date Fri, 16 Mar 2007 19:36:52 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "ink liquidation sale" <[email protected]>][Date Fri, 16 Mar 2007 15:27:17 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "AppetiteKil ... /[From suicide of <[email protected]>][Date Sat, 17 Mar 2007 21:12:19 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "AppetiteKiller" <[email protected]>][Date Fri, 16 Mar 2007 13:53:22 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "Warranty ... /[From Tim Toomay <[email protected]>][Date Tue, 02 Jan 2007 16:19:41 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "WarrantyOptions" <[email protected]>][Date Fri, 16 Mar 2007 13:21:21 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "NHIC, Corp." <[email protected]>][Date Fri, 16 Mar 2007 12:48:25 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Touch Can Opener" <OneTouch ... /[From Colette <[email protected]>][Date Fri, 16 Mar 2007 09:32:45 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Touch Can Opener" <[email protected]>][Date Fri, 16 Mar 2007 06:56:31 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From ... /[From "Jama Little" <[email protected]>][Date Fri, 16 Mar 2007 17:22:06 +0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burns ... /[From marina <[email protected]>][Date Fri, 16 Mar 2007 10:56:58 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From ... /[From "BB&T" <[email protected]>][Date Wed, 21 Mar 2007 06:47:54 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From "Ambrose Henry" <f .. ... /[From <[email protected]>][Date Wed, 21 Mar 2007 05:17:08 -0600]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From "Ambrose Henry" <f ... /[From JohnEmmy" <[email protected]>][Date 21 Mar 2007 09:49:53 -0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From "Ambrose Henry" <[email protected]>][Date Wed, 21 Mar 2007 10:28:05 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From "Ktypewritten wealthy" <[email protected]>][Date Wed, 21 Mar 2007 13:38:42 +0530]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From . ... ... /[From "Elda Thompson" <[email protected]>][Date Tue, 20 Mar 2007 23:44:57 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From . ... /[From iTunes Store <[email protected]>][Date Tue, 20 Mar 2007 23:40:31 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From ... /[Fro ... /[From "Ewast riverbank" <[email protected]>][Date Wed, 21 Mar 2007 12:11:09 +0900]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From ... /[From "anstice ... /[From "Xqrock trot" <[email protected]>][Date Wed, 21 Mar 2007 12:11:21 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From ... /[From "anstice tobin" <[email protected]>][Date Wed, 21 Mar 2007 10:24:41 +0900]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From "SatelliteTelevision" <[email protected]>][Date Tue, 20 Mar 2007 18:06:27 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... /[From "123Inkjets" <[email protected]>][Date Tue, 20 Mar 2007 17:28:30 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fro ... /[From "Ydiscrete barbell" <[email protected]>][Date Thu, 18 Jun 1987 04:49:33 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Bu ... /[From Patrick Meadows <[email protected]>][Date Tue, 20 Mar 2007 20:33:53 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "YSO-8859-1?B?T ... /[From "BB&T" <[email protected]>][Date Wed, 21 Mar 2007 22:45:27 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "YSO-8859-1?B?TW9udGFsdm8gQXJ0cyBDZW50ZXI-" <[email protected]>][Date Wed, 21 Mar 2007 18:15:14 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -05 ... /[From "WinterBlowoutSale" <[email protected]>][Date Wed, 21 Mar 2007 18:02:23 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08: ... /[From "Branch Banking and Trust" <[email protected]>][Date Fri, 23 Mar 2007 19:57:11 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... /[From "123Inkjets" <[email protected]>][Date Fri, 23 Mar 2007 18:22:57 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAME ... /[From "SearchSecrets" <[email protected]>][Date Fri, 23 Mar 2007 17:20:20 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "Branch Banking and Trust" <[email protected]>][Date Tue, 27 Mar 2007 16:44:45 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "Branch Banking and Trust" <[email protected]>][Date Tue, 27 Mar 2007 16:43:42 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... / ... /[From "Chris Lehman" <[email protected]>][Date Tue, 27 Mar 2007 20:19:28 -0060]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... /[From "Lotto Secrets" <[email protected]>][Date Tue, 27 Mar 2007 15:44:59 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From ... ... /[From Support Center <[email protected]>][Date Wed, 4 Apr 2007 00:04:54 PST]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From ... /[Fr ... /[From "Hilary Winslow" <[email protected]>][Date Wed, 4 Apr 2007 03:12:45 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From ... /[From "JMDSurveys" <[email protected]>][Date Tue, 3 Apr 2007 1 ... /[Date 6:32:12 PM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From ... /[From "JMDSurveys" <[email protected]>][Date Tue, 3 Apr 2007 16:25:11 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From "Home Improvement Depot" <[email protected]>][Date Tue, 3 Apr 2007 15:10:41 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "Branch Banking and Trust" <[email protected]>][Date Fri, 06 Apr 2007 14:47:12 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 20 ... /[From "Branch Banking and Trust" <[email protected]>][Date Fri, 6 Apr 2007 18:08:41 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "WarrantyExtensio ... /[From "PCTV" <[email protected]>][Date Fri, 6 Apr 2007 17:59:35 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "WarrantyExtension" <[email protected]>][Date Fri, 6 Apr 2007 15:32:15 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[ . ... /[From "NHIC, Corp." <[email protected]>][Date Fri, 6 Apr 2007 14:25:50 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[ ... /[From "Local Home Listings" <no ... /[From [email protected]][Date Fri, 6 Apr 2007 12:51:55 CDT]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[ ... /[From "Local Home Listings" <[email protected]>][Date Fri, 6 Apr 2007 13:43:37 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From ... /[From ... /[From "Hurry" <[email protected]>][Date Fri, 6 Apr 2007 12:42:53 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From ... /[From "gearedon.com" <[email protected]>][Date Fri, 6 Apr 2007 11:36:42 -0500 (GMT-05:00)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "Com ... /[Fr ... /[From Delbert Platt <[email protected]>][Date Wed, 6 Jun 2007 12:36:44 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "Com ... /[From [email protected] (WWW-asiakas)][Date Fri, 6 Apr 2007 17:37:12 +0300 (EEST)]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "Compliance Training" <[email protected]>][Date Fri, 6 Apr 2007 16:53:39 +0200 (SAST)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... / ... /[From "Harding Stephanie" <[email protected]>][Date Fri, 6 Apr 2007 14:59:58 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... /[From "Local Home Listings" <[email protected]>][Date Fri, 6 Apr 2007 07:08:19 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... /[From "HeartGuardian" <[email protected]>][Date Fri, 6 Apr 2007 01:58:14 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From " ... ... /[From "marriage" <[email protected]>][Date Fri, 6 Apr ... /[Date 1:45:09 AM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From " ... ... /[From "marriage" <[email protected]>][Date Fri, 6 Apr 2007 03:39:03 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From " ... /[From "bestlepus" <[email protected]>][Date Fri, 6 Apr 2007 ... /[Date 12:22:09 AM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From " ... /[From "bestlepus" <[email protected]>][Date Fri, 6 Apr 2007 01:44:26 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Bu .. . ... /[From playerThis" <[email protected]>][Date 6 Apr 2007 09:27:52 +0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Bu .. ... /[From "PCTV" <[email protected]>][Date Thu, 5 Apr 2007 21:08:46 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Bu ... /[From "Bryan" <[email protected]>][Date Thu, 5 Apr 2007 20:20:26 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[ ... ... /[From f ... /[From [email protected]][Date 7 Apr 2007 08:31:35 -0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[ ... ... /[From fifth no <[email protected]>][Date Mon, 9 Apr ... /[Date 8:34:44 PM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[ ... ... /[From fifth no <[email protected]>][Date Mon, 9 Apr 2007 11:30:46 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[ ... /[From "Gevalia" <[email protected]>][Date Sun, 8 Apr 2007 14:32:00 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[From "seewell" <[email protected]>][Date Sun, 8 Apr 2007 13:59:09 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... /[From "GovtGrants" <[email protected]>][Date Sun, 8 Apr 2007 13:10:29 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr .. ... /[From "berinte.com" <[email protected]>][Date Sun, 8 Apr 2007 11:55:07 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... ... /[From "Finance America" <ErrolGrisham @adnc.com>][Date Sun, 08 Apr 2007 08:04:24 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... /[From "BestHoodia" <[email protected]>][Date Sun, 8 Apr 2007 10:37:38 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From ... /[From "Doggy Steps" <[email protected]>][Date Sun, 8 Apr 2007 09:49:13 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Ph ... /[From "Blanca Bass" <[email protected]>][Date Wed, 8 Apr 1970 19:15:16 +0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Ph ... /[From "Pete Dawkins" <[email protected]>][Date Sun, 08 Apr 2007 18:40:08 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burns" <[email protected]>][Date Tue, 20 May 2003 09:52:29 ... /[Date 2:24:25 AM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burns" <[email protected]>][Date Tue, 20 May 2003 09:52:29 ... /[Date 1:07:40 AM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... ... /[From "Do ... /[From "BB&T" <[email protected]>][Date Mon, 9 Apr 2007 18:33:51 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "Branch Banking and Trust" <[email protected]>][Date Tue, 10 Apr 2007 08:37:23 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... ... /[From "DustBunnies" <[email protected]>][Date Tue, 10 Apr 2007 07:37:19 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "F ... /[From "Connie P. Burris" <[email protected]>][Date Tue, 10 Apr 2007 13:32:35 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "Frankie IRebecca" <[email protected]>][Date Tue, 10 Apr 2007 12:21:07 + .. ... /html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "Frankie IRebecca" <[email protected]>][Date Tue, 10 Apr 2007 12:21:07 + ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "Frankie IRebecca" <[email protected]>][Date Tue, 10 Apr 2007 12:21:07 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "CleverClasp" <[email protected]>][Date Tue, 10 Apr 2007 05:43:37 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "gd . ... /[From " ... /[From MaupinTour <[email protected]>][Date 10 Apr 2007 04:49:23 -0400]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "gd . ... /[From "Dina Hughes" <[email protected]>][Date Tue, 10 Apr 2007 15:01:10 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "gd ... /[From "Home Loan Center" <JodiKinsella @aginfort.com>][Date Mon, 09 Apr 2007 23:06:17 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "[email protected]" <[email protected]>][Date Tue, 10 Apr 2007 00:35:22 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... ... ... /[From "Bidz" <[email protected]>][Date Tue, 10 Apr 2007 00:54:01 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... ... /[From "Dartnell Corp." <[email protected]>][Date Mon, 9 Apr 2007 23:26:32 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... / ... /[From Lula prospect <[email protected]>][Date Mon, 9 Apr 2007 21:03:34 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... /[From "SleepyTim ... /[From [email protected]][Date Mon, 9 Apr 2007 20:44:17 -0400 (EDT)]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... /[From "SleepyTime" <[email protected]>][Date Mon, 9 Apr 2007 19:49:33 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From " ... /[From "Personal Care" <[email protected]>][Date Mon, 9 Apr 2007 19:08:10 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From "FreeDollarStore" <[email protected]>][Date Mon, 9 Apr 2007 19:03:15 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... ... /[From "Doub ... /[From "Punch it" <[email protected]>][Date Mon, 9 Apr 2007 18:26:57 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... ... /[From "DoubledayBookClub" <[email protected]>][Date Mon, 9 Apr 2007 16:03:55 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "WarrantyExtension" <[email protected]>][Date Mon, 9 Apr 2007 13:59:02 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500] ... /[From "Printer ink Blowout Sale" <[email protected]>][Date Mon, 9 Apr 2007 13:41:50 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UN ... /[From "WarrantyOptions" <[email protected]>][Date Mon, 9 Apr 2007 12:01:40 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From ... /[From "USGrants" <[email protected]>][Date Mon, 9 Apr 2007 10:28:10 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... /[From "BB&T" <[email protected]>][Date Tue, 10 Apr 2007 21:35:04 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[F ... /[From "USGrants" <[email protected]>][Date Tue, 10 Apr 2007 14:51:39 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fro ... /[From "USGrants" <[email protected]>][Date Tue, 10 Apr 2007 12:32:13 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Ph ... /[From "Levy County EMS" <[email protected]>][Date Tue, 10 Apr 2007 12:10:28 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burn ... /[From "Rudolph Estes" <[email protected]>][Date Wed, 11 Apr 2007 01:07:17 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNA ... /[From "Si ... /[From Abuse Team Robot <[email protected]>][Date Fri, 13 Apr 2007 15:19:34 +0800]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNA ... /[From "Simple Home Buying" <[email protected]>][Date Fri, 13 Apr 2007 02:59:38 -0400 (EDT)]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burns" <[email protected]>][Date Tue, 20 May 2003 09:52:29 -0400]/text Infected: Email-Worm.Win32.Zhelatin.ct skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skippedD:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text Infected: Email-Worm.Win32.Zhelatin.ct skippedD:\AWK\Mail\Inbox Mail Berkeley mbox: infected - 181 skippedD:\AWK\Mail\Inbox.msf Object is locked skippedD:\AWK\Mail\Trash.msf Object is locked skippedD:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skippedD:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0105873.DLL Infected: not-a-virus:Monitor.Win32.PCProtect.21 skippedD:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0105874.DLL Infected: not-a-virus:Monitor.Win32.PCProtect.21 skippedD:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\change.log Object is locked skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0070.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0071.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0073.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skippedZ:\SusBkUp\Test\clipartfree.exe/WISE0074.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k skippedZ:\SusBkUp\Test\clipartfree.exe WiseSFX: infected - 11 skippedZ:\SusBkUp\Test\clipartfree.exe WiseSFX Dropper: infected - 11 skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0084.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0084.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0084.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0087.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0087.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0087.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0088.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0090.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skippedZ:\SusBkUp\Test\lmping-clipartfree.exe/WISE0091.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.i skippedZ:\SusBkUp\Test\lmping-clipartfree.exe WiseSFX: infected - 16 skippedZ:\SusBkUp\Test\lmping-clipartfree.exe WiseSFX Dropper: infected - 16 skippedScan process completed. Edited November 16, 2007 by DaDooDaidy Link to post Share on other sites
rmurphy Posted November 17, 2007 Report Share Posted November 17, 2007 Delete the following files:Z:\SusBkUp\Test\clipartfree.exeZ:\SusBkUp\Test\lmping-clipartfree.exeSince you would like to save the emails, I recommend that you burn them to a CD in order to reduce the risk of infection.Let's make a new restore point and clear the others:Go - Start>Programmes>Accessories>System Tools>System Restore>Create a New Restore point. Go - Start>Programmes>Accessories>System Tools>Disc Cleanup>"More Options" Tab>Remove All But Most Recent Point. Please repeat this step for all drives listed when you fisrt open Disc Cleanup.Reboot your computer.If you would please rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working. -Ryan Link to post Share on other sites
DaDooDaidy Posted November 17, 2007 Author Report Share Posted November 17, 2007 I deleted the two files.I cannot get to System Restore after Programs in the Start Menu, even if I switch it to classic view.I used Windows Explorer and found it here:C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System ToolsI get the following message...System Restore is not able to protect your computer. Please restart your computer, and then run System Restore again.I moved the old email from the previous version to put on CD later. Or I might decide to delete that folder.I think I need to continue saving what I need to from the current folder and delete the rest. Link to post Share on other sites
rmurphy Posted November 18, 2007 Report Share Posted November 18, 2007 Right click on My Computer and select Properties. Do you see a tab labelled System Restore? If not, does your account have administrator rights?-Ryan Link to post Share on other sites
DaDooDaidy Posted November 18, 2007 Author Report Share Posted November 18, 2007 Yes, I do. Link to post Share on other sites
rmurphy Posted November 19, 2007 Report Share Posted November 19, 2007 On the System Restore tab, is System Restore enabled? If not, turn it on, and reboot. If it is already on, turn it off, reboot, and turn it back on.Let me know what the results of that are.-Ryan Link to post Share on other sites
DaDooDaidy Posted November 19, 2007 Author Report Share Posted November 19, 2007 (edited) Yes, the tab is enabled. When I check the box for 'turn off System Restore on all drives', a confirmation message says all existing restore points will be deleted and I will not be able to track or undo changes to the computer. I clicked Yes and it says it encountered an error trying to enable/disable one or more drives (C and D). Please restart machine and try again. Now the box is unchecked.It looks like I'm unable to check the box to turn if off, reboot, then check the box again.P.S. I'm still getting an option to update system and shutdown when the computer is turned off. Since I don't know what the updates are and I want to make sure the computer will turn on again. I keep changing the option to shutdown only. Edited November 19, 2007 by DaDooDaidy Link to post Share on other sites
rmurphy Posted November 20, 2007 Report Share Posted November 20, 2007 The updates are most likely the monthly updates from Microsoft, and are safe to install, and should be installed.Are you having any problems besides the system restore?-Ryan Link to post Share on other sites
DaDooDaidy Posted November 20, 2007 Author Report Share Posted November 20, 2007 The computer loads up faster than it used to since I did the virus scans. I still have these things.There is no list after All Programs in the start menu, there is no recycle bin and the modem is not functioning. If I type an incorrect url in the Mozilla Firefox browser, it will seem to hang with a connection dialog and then nothing works until the browser is closed and started again. When I print a document, I get a Windows Installer dialog that I have to cancel and close, but it still prints.When I lose the connection dialog without closing the browser, it still seems to work okay. Although yesterday some pages were not showing up and the images disappeared. Then I cleared all private data and it was okay. I'm using Mozilla Firefox.Thanks for telling me about the updates and shutdown message.There are a couple of other messages that I get from SpyBot. Both from Session Manager:Value Deleted. First is BootExecute- old data: autocheck autochk * and the second is ExcludeFromKnownDlls. I'm not sure what these are yet, so I deny the changes without using the 'remember this decision' option until I know for sure.I still get a blank dialog box with something that looks like brackets in the upper left corner when the computer boots up, but doesn't happen when computer is restarted. This happens before the normal user login and password. I can't close the blank box without hitting the button. Link to post Share on other sites
rmurphy Posted November 22, 2007 Report Share Posted November 22, 2007 This post should help with the items SpyBot is saying: http://forums.spybot.info/showpost.php?p=6...amp;postcount=3The rest of your issues do not appear to be malware related, and should be posted about in the Windows forum.Congratulations, your log is clean For information on how to protect yourself in the future, read Infection PreventionDo you have any other questions or concerns? This thread will be left open for a few more days, so feel free to ask.-Ryan Link to post Share on other sites
DaDooDaidy Posted November 23, 2007 Author Report Share Posted November 23, 2007 Thank you very much for your help and the links. I did those steps with the Tea Timer, but it didn't help for some reason. You're right the other problems are Windows related. I had to reinstall Windows XP. The problems I mentioned have gone away. I still have all my files including the applications, but need to reinstall everything to synchronize the computer.This is a great site. I would love to learn more or maybe take a class later. Link to post Share on other sites
Andro1d Posted December 4, 2007 Report Share Posted December 4, 2007 Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic. Link to post Share on other sites
Recommended Posts