White Screen Blocking Center Of Screen, Swp2009

lashaun84 · February 13, 2009

Logfile of HijackThis v1.99.1

Scan saved at 9:12:58 AM, on 11/02/2009

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\System32\hkcmd.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\D-Link\AirPlus G\AirGCFG.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\WINDOWS\System32\baloon.exe

C:\WINDOWS\System32\rundll32.exe

C:\DOCUME~1\Owner\LOCALS~1\Temp\winlognn.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe

C:\WINDOWS\sysguard.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\office.exe

C:\DOCUME~1\Owner\LOCALS~1\Temp\csrssc.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Owner\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adserving.cpxinteractive.com/iframe...a4-000b6aa2a5f8

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: MyIdentityDefender - {A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - C:\Documents and Settings\Owner\Local Settings\Application Data\CyberDefender\cdmyidd.dll

O1 - Hosts: 195.245.119.131 browser-security.microsoft.com

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: MyIdentityDefender - {A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - C:\Documents and Settings\Owner\Local Settings\Application Data\CyberDefender\cdmyidd.dll

O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe

O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [1331176861] "C:\Documents and Settings\All Users\Application Data\1447988137\1331176861.exe"

O4 - HKLM\..\Run: [C:\WINDOWS\System32\baloon.exe] C:\WINDOWS\System32\baloon.exe

O4 - HKLM\..\Run: [Rhoyezudana] rundll32.exe "C:\WINDOWS\Szinoceqozuzeqij.dll",e

O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\Owner\LOCALS~1\Temp\winlognn.exe

O4 - HKLM\..\Run: [Gyoyaveca] rundll32.exe "C:\WINDOWS\uciqamalanunevif.dll",e

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [A00F2EE4C2.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F2EE4C2.exe

O4 - HKCU\..\Run: [A00F530BC.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F530BC.exe

O4 - HKCU\..\Run: [A00F3803D8.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F3803D8.exe

O4 - HKCU\..\Run: [RegTool] C:\Program Files\RegTool\RegTool.exe -boot

O4 - HKCU\..\Run: [A00F978B69.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F978B69.exe

O4 - HKCU\..\Run: [A00F5F98A.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F5F98A.exe

O4 - HKCU\..\Run: [uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S

O4 - HKCU\..\Run: [A00FBD9DF.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00FBD9DF.exe

O4 - HKCU\..\Run: [A00F31CA1.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F31CA1.exe

O4 - HKCU\..\Run: [A00FA2C2F.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00FA2C2F.exe

O4 - HKCU\..\Run: [A00FAAE31.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00FAAE31.exe

O4 - HKCU\..\Run: [A00F2F17A.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F2F17A.exe

O4 - HKCU\..\Run: [A00F67438.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F67438.exe

O4 - HKCU\..\Run: [A00FF0B9F.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00FF0B9F.exe

O4 - HKCU\..\Run: [A00F3AEDF.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F3AEDF.exe

O4 - HKCU\..\Run: [A00F31BA7.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F31BA7.exe

O4 - HKCU\..\Run: [A00F41F8A.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F41F8A.exe

O4 - HKCU\..\Run: [A00F2F67B.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F2F67B.exe

O4 - HKCU\..\Run: [A00F3ECC2.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F3ECC2.exe

O4 - HKCU\..\Run: [A00F2FCB5.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F2FCB5.exe

O4 - HKCU\..\Run: [A00F643F1.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F643F1.exe

O4 - HKCU\..\Run: [A00F3DBEA.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F3DBEA.exe

O4 - HKCU\..\Run: [A00F2FE9A.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F2FE9A.exe

O4 - HKCU\..\Run: [A00F5316C0.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F5316C0.exe

O4 - HKCU\..\Run: [A00F5425CF.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F5425CF.exe

O4 - HKCU\..\Run: [MalwareBot] C:\Program Files\MalwareBot\MalwareBot.exe -boot

O4 - HKCU\..\Run: [A00FE2A77.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00FE2A77.exe

O4 - HKCU\..\Run: [A00F1B2344.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F1B2344.exe

O4 - HKCU\..\Run: [A00F41672.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F41672.exe

O4 - HKCU\..\Run: [A00F49140.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F49140.exe

O4 - HKCU\..\Run: [A00F5579D.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F5579D.exe

O4 - HKCU\..\Run: [A00F142019.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F142019.exe

O4 - HKCU\..\Run: [A00F151F3A.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F151F3A.exe

O4 - HKCU\..\Run: [A00F50779.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F50779.exe

O4 - HKCU\..\Run: [A00F133617.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F133617.exe

O4 - HKCU\..\Run: [A00F180366.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F180366.exe

O4 - HKCU\..\Run: [A00F18E4CD.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F18E4CD.exe

O4 - HKCU\..\Run: [A00F49BD03.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F49BD03.exe

O4 - HKCU\..\Run: [A00F8C0A9.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F8C0A9.exe

O4 - HKCU\..\Run: [A00FDDE79.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00FDDE79.exe

O4 - HKCU\..\Run: [A00F4BB6D.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F4BB6D.exe

O4 - HKCU\..\Run: [sysguard] C:\WINDOWS\sysguard.exe

O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\Owner\LOCALS~1\Temp\winlognn.exe

O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\DOCUME~1\Owner\LOCALS~1\Temp\csrssc.exe

O4 - HKCU\..\Run: [A00FFAA12.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00FFAA12.exe

O4 - HKCU\..\Run: [A00F5114D.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F5114D.exe

O4 - HKCU\..\Run: [A00FFFE1D.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00FFFE1D.exe

O4 - HKCU\..\Run: [A00F1849C6.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F1849C6.exe

O4 - HKCU\..\Run: [A00F7D30D.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F7D30D.exe

O4 - HKCU\..\Run: [A00F50854.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F50854.exe

O4 - HKCU\..\Run: [A00F80EAE.exe] C:\DOCUME~1\Owner\LOCALS~1\Temp\_A00F80EAE.exe

O4 - Global Startup: office.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {21BB8360-F943-447E-98F3-3C22345375A7} (CPlayFirstChocolatieControl Object) - http://zone.msn.com/bingame/choc/default/C...eb.1.0.0.15.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1213917412731

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1213962550419

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab

O16 - DPF: {E9B80D94-D8BC-43DE-9138-75605A8D9666} (CPlayFirstWeddingDasControl Object) - http://zone.msn.com/bingame/wedd/default/W...sh.1.0.0.50.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{256BB56E-10EE-4BEB-AA15-49F444D132BD}: NameServer = 85.255.112.39,85.255.112.40

O17 - HKLM\System\CCS\Services\Tcpip\..\{C7EB3819-3812-4E2C-91CF-A606F639C246}: NameServer = 85.255.112.39,85.255.112.40

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40

O17 - HKLM\System\CS1\Services\Tcpip\..\{256BB56E-10EE-4BEB-AA15-49F444D132BD}: NameServer = 85.255.112.39,85.255.112.40

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40

O17 - HKLM\System\CS2\Services\Tcpip\..\{256BB56E-10EE-4BEB-AA15-49F444D132BD}: NameServer = 85.255.112.39,85.255.112.40

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40

O20 - AppInit_DLLs: C:\WINDOWS\System32\dpnlobby32.dll,C:\WINDOWS\System32\dpnlobby32.dll sdfqxl.dll cnpvkf.dll xhedsz.dll zdnvjq.dll

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

therock247uk · February 14, 2009

Can you please follow this topic? http://www.besttechie.net/forums/index.php?showtopic=12175

Your Hijackthis version etc are out of date.

lashaun84 · February 16, 2009

Malwarebytes' Anti-Malware 1.34

Database version: 1764

Windows 5.1.2600

15/02/2009 7:25:08 PM

mbam-log-2009-02-15 (19-25-07).txt

Scan type: Quick Scan

Objects scanned: 74163

Time elapsed: 15 minute(s), 50 second(s)

Memory Processes Infected: 5

Memory Modules Infected: 10

Registry Keys Infected: 50

Registry Values Infected: 56

Registry Data Items Infected: 16

Folders Infected: 4

Files Infected: 286

Memory Processes Infected:

C:\Documents and Settings\Owner\Local Settings\Temp\winlognn.exe (Trojan.Downloader) -> Unloaded process successfully.

C:\WINDOWS\sysguard.exe (Trojan.Downloader) -> Unloaded process successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Unloaded process successfully.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\office.exe (Trojan.Downloader) -> Unloaded process successfully.

C:\WINDOWS\system32\baloon.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:

C:\WINDOWS\system32\fccaBQHY.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\Szinoceqozuzeqij.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\sdfqxl.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\cnpvkf.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\xhedsz.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\viorxs.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\urqNfCTn.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Downloader) -> Delete on reboot.

C:\WINDOWS\system32\hsfd83jfdg.dll (Trojan.Downloader) -> Delete on reboot.

C:\WINDOWS\system32\__c009CFE2.dat (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqnfctn (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97bc5159-1d8e-4d18-9b4e-5575041309a8} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{97bc5159-1d8e-4d18-9b4e-5575041309a8} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{c5bf49a2-94f3-42bd-f434-3604812c8955} (Trojan.Zlob.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{97ac8336-c41b-4d04-aba6-c727e8c24588} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{71a5fc36-8827-45ff-98ed-bd0f7330b414} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{cde2b712-04a3-4f2c-ba07-6b2d0fc8411c} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{71e232e9-753a-4e35-8a49-dfcfa5986a28} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winctrl32 (Trojan.Downloader) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5bf49a2-94f3-42bd-f434-3604812c8955} (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\cdmyidd.securitytoolbar (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{cd24eb02-9831-4838-99d0-726d411b1328} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f20da564-9254-49fe-a678-cc3cef172252} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\cdmyidd.securitytoolbar.1 (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{5cc2f638-99ff-45d2-97c7-e30e83cf04d2} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{36dbc179-a19f-48f2-b16a-6a3e19b42a87} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{36dbc179-a19f-48f2-b16a-6a3e19b42a87} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{dcfba5e4-23ed-49f9-a5c2-99607670da51} (Spyware.BZub) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dcfba5e4-23ed-49f9-a5c2-99607670da51} (Spyware.BZub) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{32123989-5e4a-47da-bd3f-75e46c4c75d6} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{51008f05-10d7-4981-a349-cde667a546bc} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{85fb89b6-38d9-4b04-8512-c90471161acb} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winvc05 (Rootkit.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\winvc05 (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winvc05 (Rootkit.Agent) -> Delete on reboot.

HKEY_CLASSES_ROOT\coolplay (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\MalwareBot (Rogue.MalwareBot) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c009cfe2 (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\freshplay (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ccf7760d (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c5bf49a2-94f3-42bd-f434-3604812c8955} (Trojan.Zlob.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysguard (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rhoyezudana (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jsf8uiw3jnjgffght (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jsf8uiw3jnjgffght (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tezrtsjhfr84iusjfo84f (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gyoyaveca (Trojan.Agent) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f530bc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f5f98a.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00fbd9df.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f31ca1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00fa2c2f.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00faae31.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f2f17a.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f67438.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00ff0b9f.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f3aedf.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f31ba7.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f41f8a.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f2f67b.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f3ecc2.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f2fcb5.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f643f1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f3dbea.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f2fe9a.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00fe2a77.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f41672.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f49140.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f5579d.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f50779.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f8c0a9.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00fdde79.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f4bb6d.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00ffaa12.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f5114d.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00fffe1d.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f7d30d.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f50854.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f80eae.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f4c262.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f69686.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f60820.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f65239.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f79eaf.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00f55bc3.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c:\windows\system32\baloon.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\fccabqhy -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccabqhy -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{256bb56e-10ee-4beb-aa15-49f444d132bd}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c7eb3819-3812-4e2c-91cf-a606f639c246}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c7eb3819-3812-4e2c-91cf-a606f639c246}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{256bb56e-10ee-4beb-aa15-49f444d132bd}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{c7eb3819-3812-4e2c-91cf-a606f639c246}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{c7eb3819-3812-4e2c-91cf-a606f639c246}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{256bb56e-10ee-4beb-aa15-49f444d132bd}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{c7eb3819-3812-4e2c-91cf-a606f639c246}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{c7eb3819-3812-4e2c-91cf-a606f639c246}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.39,85.255.112.40 -> Quarantined and deleted successfully.

Folders Infected:

C:\Documents and Settings\Owner\Application Data\MalwareBot (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Settings (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Start Menu\Programs\coolplay (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:

C:\WINDOWS\system32\urqNfCTn.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\fccaBQHY.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\YHQBaccf.ini (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\YHQBaccf.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\batvsgta.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\atgsvtab.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\bibunsdn.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ndsnubib.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\blbscvoa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\aovcsblb.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\bvevvgfv.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\vfgvvevb.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\gyspqvle.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\elvqpsyg.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\iqqdihvo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ovhidqqi.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\jvqjthmf.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\fmhtjqvj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qhwsqhqx.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xqhqswhq.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rbxlgsjx.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xjsglxbr.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ujwgxjai.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\iajxgwju.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wjwxiomp.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pmoixwjw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xntiicwe.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ewciitnx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\hsfd83jfdg.dll (Trojan.Zlob.H) -> Delete on reboot.

C:\WINDOWS\sysguard.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

C:\WINDOWS\Szinoceqozuzeqij.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\sdfqxl.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\cnpvkf.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\xhedsz.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\viorxs.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Downloader) -> Delete on reboot.

C:\Documents and Settings\Owner\Local Settings\Temp\winlognn.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\office.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F2EE4C2.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F530BC.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F3803D8.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F978B69.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F5F98A.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FBD9DF.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F31CA1.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FA2C2F.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FAAE31.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F2F17A.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F67438.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FF0B9F.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F3AEDF.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F31BA7.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F41F8A.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F2F67B.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F3ECC2.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F2FCB5.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F643F1.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F3DBEA.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F2FE9A.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F5316C0.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F5425CF.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FE2A77.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F1B2344.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F41672.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F49140.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F5579D.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F142019.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F151F3A.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F50779.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F133617.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F180366.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F18E4CD.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F49BD03.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F8C0A9.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FDDE79.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F4BB6D.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FFAA12.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F5114D.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FFFE1D.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F1849C6.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F7D30D.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F50854.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F80EAE.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F4C262.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F69686.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F60820.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F65239.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F79EAF.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F55BC3.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Application Data\CyberDefender\cdmyidd.dll (Trojan.BHO) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ipv6sp.dll (Trojan.BHO) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\iehelper.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\fgrrrgoe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\fnoxefcd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\oqqmjcek.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ajwjfbbe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\avica.dll (Spyware.BZub) -> Delete on reboot.

C:\WINDOWS\system32\bmecmq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\brahuudv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\cmopdz.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\dswxrrpx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\gacehj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\gqbppt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\isuoos.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\itoyulfo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kcfkmvfb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ltsnlhuu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\oaqhkrsy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pivfwkhl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rrrrkbno.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rvpvqara.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSScfub.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSSnrsr.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSSoeqh.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSSriqp.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rcuguuib.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ucukblls.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\uhfgdxsp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\iapcigym.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\uukwoo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\uxldcoud.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\juwuwlft.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\moyxvb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wikyvfro.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\WinCtrl32.dl_ (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xdkcnehl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xvbgualt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\zxqhpt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\crypt3.dll (Spyware.BZub) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\yemfpwvm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kxkhhh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\lkybsbto.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\tpxooqub.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mcbolojw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\TDSSmaxt.sys (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\Winvc05.sys (Rootkit.Agent) -> Delete on reboot.

C:\beX.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\dhxbxshe.exe (Backdoor.Frauder) -> Quarantined and deleted successfully.

C:\qvwi.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\shvmjqoq.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\uspud.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-436374069-1364589140-1801674531-1003\Dc3.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\13.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\14.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\16.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\17.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\18.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\19.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\1B.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\1E.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\1F.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\tsjmcmbq.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\uktkwbyp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\whshpbxw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\vknkbatr.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\vwtskrrl.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\w32NOFJCyliz5mm5R.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\20.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\50.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\7.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\A.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\B.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\F.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\nlarqlpp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\phrxdswg.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\8.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\9.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\wmwhoinh.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F1A11735.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F1B121D.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F1D452.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F1DD2F2.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F25C01.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F2DCC9.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\skovhcvn.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F6AED0.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F6C278.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F72400.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F149D5.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F30418.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F44514.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\poargciw.exe (Rootkit.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\qjmqxunc.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\qragvkli.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\qthkeiyd.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\qxbwkmer.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FE43C19.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FEAC87E.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FEC4E24.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FF46F3.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\5B.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\6.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F34BC0.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F352B5.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F35BF85.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F37E0B.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F427E7.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\tkksjbkp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\xgvaijsh.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\xlpxaduv.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\xmebeova.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\xrfqhepi.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\xwfwsuos.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\yrywryej.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\yxyqtjex.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\yyemkxuw.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\C.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\gvtnyghd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F450FB.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F4853A.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F4E4923.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F4F3E2.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F55EA2.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F5BAAC.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\22.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\23.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\24.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\27.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\2D.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\2F.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\3.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\338.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F84A46B.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F880D1.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F99D3E.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FBC945.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\_A00FBCB97.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\BN2.tmp (Rootkit.Dropper) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\BN3.tmp (Rootkit.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\rs.dat (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 05 - 02_02_31 PM_200.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 05 - 04_02_41 PM_513.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 05 - 05_26_15 PM_342.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 05 - 07_37_19 PM_046.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 05 - 07_43_56 PM_889.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 05 - 11_21_31 AM_651.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 09 - 02_13_41 PM_061.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 09 - 05_13_24 PM_357.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 10 - 03_11_45 PM_015.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 10 - 09_07_09 AM_686.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 10 - 09_48_56 AM_983.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 10 - 10_23_04 AM_076.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 10 - 11_16_38 AM_545.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Log\2009 Feb 10 - 12_35_53 PM_514.log (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Application Data\MalwareBot\Settings\ScanResults.pie (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\WINDOWS\Tasks\MalwareBot Scheduled Scan.job (Rogue.MalwareBot) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\uciqamalanunevif.dll (Trojan.Agent) -> Delete on reboot.

C:\autorun.inf (Trojan.Agent) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-8-30-100002726-100015695-100032054-4230.com (Trojan.Agent) -> Quarantined and deleted successfully.

C:\RECYCLER\S-6-6-79-100023757-100003572-100027689-8619.com (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\gaopdxserv.sys (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\bb1.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ps1.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rc.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\ktpcd.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Mozilla Firefox\components\iamfamous.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c009CFE2.dat (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\__c002411A.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c002ADA4.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c0076D4.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00867BF.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00A97DB.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00D9C03.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00E3787.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00F9F10.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\cs.dat (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\nnnkLcAr.dll (Backdoor.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qoMCrpOF.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\geBtUlMe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\opnmMEwt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\nnnopNGY.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pmnlkLdb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ljJYPJab.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wvUoOfGx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\baloon.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\cfrog.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\TDSS73d3.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\tempo-1858406.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\tempo-1866609.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\tempo-3733953.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\tempo-3768312.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSSfpmp.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSStkdv.log (Trojan.TDSS) -> Quarantined and deleted successfully.

therock247uk · February 16, 2009

Please download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases

[*]Click on My Computer under Scan.

[*]Once the scan is complete, it will display the results. Click on View Scan Report.

[*]You will see a list of infected items there. Click on Save Report As....

[*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

lashaun84 · February 17, 2009

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7 REPORT

Monday, February 16, 2009

Operating System: Microsoft Windows XP Home Edition (build 2600)

Kaspersky Online Scanner 7 version: 7.0.25.0

Program database last update: Monday, February 16, 2009 21:45:28

Records in database: 1804985

--------------------------------------------------------------------------------

Scan settings:

Scan using the following database: extended

Scan archives: yes

Scan mail databases: yes

Scan area - My Computer:

A:\

C:\

D:\

Scan statistics:

Files scanned: 37986

Threat name: 30

Infected objects: 223

Suspicious objects: 1

Duration of the scan: 01:56:18

File name / Threat name / Threats count

winlogon.exe\dpnlobby32.dll/winlogon.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

C:\WINDOWS\System32\dpnlobby32.dll/C:\WINDOWS\System32\dpnlobby32.dll Infected: P2P-Worm.Win32.Nugg.af 22

C:\WINDOWS\system32\zdnvjq.dll/C:\WINDOWS\system32\zdnvjq.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.izl 7

C:\WINDOWS\system32\rukcng.dll/C:\WINDOWS\system32\rukcng.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.jmn 7

services.exe\dpnlobby32.dll/services.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

C:\WINDOWS\System32\__c00B9C2.dat/C:\WINDOWS\System32\__c00B9C2.dat Infected: Backdoor.Win32.Agent.aawp 13

lsass.exe\dpnlobby32.dll/lsass.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

svchost.exe\dpnlobby32.dll/svchost.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 4

C:\WINDOWS\System32\zdnvjq.dll/C:\WINDOWS\System32\zdnvjq.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.izl 16

C:\WINDOWS\System32\rukcng.dll/C:\WINDOWS\System32\rukcng.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.jmn 16

spoolsv.exe\dpnlobby32.dll/spoolsv.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

jqs.exe\dpnlobby32.dll/jqs.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

wdfmgr.exe\dpnlobby32.dll/wdfmgr.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

explorer.exe\dpnlobby32.dll/explorer.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

jusched.exe\dpnlobby32.dll/jusched.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

realsched.exe\dpnlobby32.dll/realsched.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

issch.exe\dpnlobby32.dll/issch.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

ctfmon.exe\dpnlobby32.dll/ctfmon.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

firefox.exe\dpnlobby32.dll/firefox.exe\dpnlobby32.dll Infected: Trojan.Win32.Agent.bkpf 1

C:\!FixIEDef\1.tmp Infected: Trojan.Win32.Agent2.abb 1

C:\!FixIEDef\__c0013A16.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0019544.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00210E4.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0023CC6.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0025964.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c002A68A.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c002F1E4.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0034F69.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0042D21.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0044C2B.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c004AF7B.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c004C291.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0051F8F.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0052589.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c005670D.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0058519.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0059AEE.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c005E189.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0061FB5.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0065744.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0068A40.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c006961B.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c006FE92.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c007592E.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c007D907.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0086EC0.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c008D81A.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c008E442.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00912FE.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0094E24.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c0096412.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c009AF9A.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c009CFE2.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c009E490.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c009EE1C.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00A024E.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00A481B.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00A4916.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00A5BC1.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00A6853.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00AA101.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00AA59C.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00B4731.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00B7984.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00BB0C4.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00BBF55.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00BE2B5.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00C3440.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00C4CC1.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00C7EFE.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00C9254.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00CA6E4.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00D7B79.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00DB189.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00DB1B2.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00DF600.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00E6129.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00E65D1.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00E8841.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00EA9A1.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00F38C4.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00F3964.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00F4BC0.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00F6B82.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00F7A7A.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\!FixIEDef\__c00FF2EC.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\Documents and Settings\All Users\Application Data\1447988137\1331176861.exe Infected: Trojan.Win32.Agent.bkws 1

C:\Documents and Settings\Owner\Desktop\Incomplete\Preview-T-3515163-busted ron isley.wma Infected: Trojan-Downloader.WMA.Wimad.n 1

C:\Documents and Settings\Owner\Desktop\Incomplete\Preview-T-3545427-drama - not today.mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1

C:\Documents and Settings\Owner\Desktop\Incomplete\Preview-T-5745425-i love you musiq.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1

C:\Documents and Settings\Owner\Desktop\Incomplete\T-5745425-i love you musiq.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1

C:\Documents and Settings\Owner\Desktop\MUSIC\yesterday dorinda clark cole.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1

C:\Documents and Settings\Owner\Local Settings\Temp\qaafAtHj.exe Infected: Packed.Win32.Krap.j 1

C:\Documents and Settings\Owner\Local Settings\Temp\Rbqlljsg.exe Infected: Trojan-Downloader.Win32.FraudLoad.dcn 1

C:\Documents and Settings\Owner\Local Settings\Temp\rMsUoOvu.exe Infected: Trojan.Win32.Inject.ott 1

C:\Documents and Settings\Owner\Local Settings\Temp\rpwByoTs.exe Infected: Trojan-Downloader.Win32.FraudLoad.dar 1

C:\Documents and Settings\Owner\Local Settings\Temp\TDSS777.tmp Infected: Packed.Win32.Tdss.a 1

C:\Documents and Settings\Owner\Local Settings\Temp\TDSS9e8.tmp Suspicious: Trojan.Win32.Patched.dy 1

C:\Documents and Settings\Owner\Local Settings\Temp\TeuDbAVS.exe Infected: Trojan-Downloader.Win32.Agent.bfut 1

C:\Documents and Settings\Owner\Local Settings\Temp\TgWNhCKv.exe Infected: Trojan-Downloader.Win32.Agent.bgoh 1

C:\Documents and Settings\Owner\Local Settings\Temp\tJPGmmFV.exe Infected: Rootkit.Win32.TDSS.eyj 1

C:\Documents and Settings\Owner\Local Settings\Temp\tmp45C.tmp Infected: Rootkit.Win32.TDSS.eyj 1

C:\Documents and Settings\Owner\Local Settings\Temp\tmp50.tmp Infected: Rootkit.Win32.TDSS.eyj 1

C:\Documents and Settings\Owner\Local Settings\Temp\tmpAC.tmp Infected: Rootkit.Win32.TDSS.eyj 1

C:\Documents and Settings\Owner\Local Settings\Temp\towlorsb.exe Infected: Worm.Win32.AutoTDSS.bpj 1

C:\Documents and Settings\Owner\Local Settings\Temp\uiucdugC.exe Infected: Trojan-Downloader.Win32.Agent.bgoh 1

C:\Documents and Settings\Owner\Local Settings\Temp\uXLdLGVr.exe Infected: Packed.Win32.Krap.j 1

C:\Documents and Settings\Owner\Local Settings\Temp\viDqrvHW.exe Infected: Packed.Win32.Krap.j 1

C:\Documents and Settings\Owner\Local Settings\Temp\WiivGWch.exe Infected: Packed.Win32.Krap.j 1

C:\Documents and Settings\Owner\Local Settings\Temp\winiguard.exe Infected: not-a-virus:FraudTool.Win32.SpyVampire.h 1

C:\Documents and Settings\Owner\Local Settings\Temp\WqgnSSFM.exe Infected: Packed.Win32.Krap.j 1

C:\Documents and Settings\Owner\Local Settings\Temp\wxUlNgTk.exe Infected: Trojan.Win32.Agent.bntk 1

C:\Documents and Settings\Owner\Local Settings\Temp\XafEmLbp.exe Infected: Trojan-Downloader.Win32.Agent.bgoh 1

C:\Documents and Settings\Owner\Local Settings\Temp\XkpGthFn.exe Infected: Trojan-Downloader.Win32.FraudLoad.dcm 1

C:\Documents and Settings\Owner\Local Settings\Temp\xWSkHbjW.exe Infected: Trojan-Downloader.Win32.FraudLoad.dar 1

C:\Documents and Settings\Owner\Local Settings\Temp\YFIDhgpp.exe Infected: Trojan.Win32.Inject.ott 1

C:\Documents and Settings\Owner\Local Settings\Temp\yhRBGxyE.exe Infected: Packed.Win32.Krap.j 1

C:\Documents and Settings\Owner\Local Settings\Temp\_A00F28F94.exe Infected: Backdoor.Win32.Agent.aawp 1

C:\Program Files\Common Files\aolback\Comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1

C:\WINDOWS\system32\dpnlobby32.dll Infected: P2P-Worm.Win32.Nugg.af 1

C:\WINDOWS\system32\GroupPolicyManifest\39.music.mp3 Infected: Trojan-Downloader.WMA.GetCodec.u 1

C:\WINDOWS\system32\GroupPolicyManifest\41.crack.zip Infected: P2P-Worm.Win32.Nugg.w 3

C:\WINDOWS\system32\GroupPolicyManifest\42.keymaker.zip Infected: P2P-Worm.Win32.Nugg.w 2

C:\WINDOWS\system32\GroupPolicyManifest\43.setup.zip Infected: P2P-Worm.Win32.Nugg.w 2

C:\WINDOWS\system32\GroupPolicyManifest\44.unpack.zip Infected: P2P-Worm.Win32.Nugg.w 1

C:\WINDOWS\system32\GroupPolicyManifest\45.keygen.zip Infected: P2P-Worm.Win32.Nugg.w 2

C:\WINDOWS\system32\GroupPolicyManifest\46.serial.zip Infected: P2P-Worm.Win32.Nugg.w 2

C:\WINDOWS\system32\GroupPolicyManifest\47.music.snd Infected: Trojan-Downloader.WMA.GetCodec.s 1

C:\WINDOWS\system32\kjepncko.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.izl 1

C:\WINDOWS\system32\ndqnvhgv.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.jep 1

C:\WINDOWS\system32\qigkdfeq.dll Infected: Trojan.Win32.Monder.avau 1

C:\WINDOWS\system32\rasha.exe Infected: Trojan.Win32.Agent2.bhm 1

C:\WINDOWS\system32\rukcng.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.jmn 1

C:\WINDOWS\system32\sjiznr.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.jep 1

C:\WINDOWS\system32\tqtraqcu.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.jmn 1

C:\WINDOWS\system32\wkzrha.dll Infected: Trojan.Win32.Monder.avau 1

C:\WINDOWS\system32\zdnvjq.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.izl 1

C:\WINDOWS\system32\__c00B9C2.dat Infected: Backdoor.Win32.Agent.aawp 1

C:\WINDOWS\Temp\tempo-24481125.tmp Infected: Rootkit.Win32.TDSS.eyj 1

C:\WINDOWS\Temp\tempo-24486062.tmp Infected: Rootkit.Win32.TDSS.eyj 1

The selected area was scanned.

therock247uk · February 17, 2009

Ok post me a fresh Hijackthis log and we will go from there.

lashaun84 · February 17, 2009

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:39:45 AM, on 17/02/2009

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\System32\hkcmd.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\D-Link\AirPlus G\AirGCFG.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://adserving.cpxinteractive.com/iframe...a4-000b6aa2a5f8

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O1 - Hosts: 195.245.119.131 browser-security.microsoft.com

O2 - BHO: (no name) - {DCFBA5E4-23ED-49F9-A5C2-99607670DA51} - C:\WINDOWS\System32\avica.dll