Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Am I clean? [CLOSED]

Started by Lava Luke , May 16 2005 02:01 PM

This topic is locked

#1
Lava Luke

Posted 16 May 2005 - 02:01 PM

New Member

Member
7 posts

Tonight I had a few Aurora pop-ups but it looks like I have managed to get rid of them with an uninstaller that I found through a few searches. But recently I have noticed pop ups getting more frequent and wondered if you guys could help me out, I'm a novice at this so please... be gentle :tazz:

Logfile of HijackThis v1.99.1
Scan saved at 20:54:02, on 16/05/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\mfcqq.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svhost.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\WINDOWS\System32\ICO.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\javadz32.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\NORTON~2\navapw32.exe
C:\WINDOWS\System32\video.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\System32\ap9h4qmo.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DV Series\Console\Watch.exe
C:\Program Files\AOL 9.0b\waol.exe
C:\Program Files\AOL 9.0b\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\program files\internet explorer\iexplore.exe
C:\Documents and Settings\luke\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vtjvk.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vtjvk.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vtjvk.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vtjvk.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vtjvk.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vtjvk.dll/sp.html#22776
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vtjvk.dll/sp.html#22776
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: run=C:\WINDOWS\System32\svhost.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {6066ED84-9482-035D-8C41-A478FA40EFE9} - C:\WINDOWS\ntxq32.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRA~1\YOURSI~1\ys2.dll (file missing)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [eanth_critical_update_alert] C:\PROGRA~1\ACCELE~1\ANTI-V~1\EANTH_~1.EXE /Startup
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [javadz32.exe] C:\WINDOWS\javadz32.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~2\Cfgwiz.exe /R
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~2\navapw32.exe
O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\System32\video.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [RSync] C:\WINDOWS\System32\netsync.exe
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\System32\video.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0b\aoltray.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Ulead Photo Express Calendar Checker For My Custom Edition.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe
O4 - Global Startup: Watch.lnk = C:\Program Files\DV Series\Console\Watch.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O15 - Trusted Zone: *.addictivetechnologies.com (HKLM)
O15 - Trusted Zone: *.addictivetechnologies.net (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.c4tdownload.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.megapornix.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.overpro.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topcon...activex/mp3.ocx
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180search...com/180saax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CECF55B6-09D8-40C1-AF1D-CA41027244C0}: NameServer = 205.188.146.145
O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\mfcqq.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe

#2
Guest_usetobe_*

Posted 21 May 2005 - 04:23 AM

Guest

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP, or Service Pack 4 if you are running Win2k. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here
Apply the update, reboot, and post a fresh Hijack This log.

#3
Lava Luke

Posted 21 May 2005 - 02:42 PM

New Member

Topic Starter
Member
7 posts

Thanks for your help so far, I downloaded the service pack 2 because I couldn't find 1a. Hope that's ok.

It took a long time and once it finished I re-booted, ever since then I haven't been able to click on anything in my desktop or do anything to get me into any files. The only thing I can do is load AOL and get into 'All Programs'.

Because of this I can't post a HiJackThis log (as its on my desktop) at this time. Anymore ideas?

Thanks

#4
Guest_usetobe_*

Posted 21 May 2005 - 02:44 PM

Guest

Uninstall SP2 IN ADD/REMOVE in control panel and click link below for SP1a

SP1a

#5
Lava Luke

Posted 21 May 2005 - 04:31 PM

New Member

Topic Starter
Member
7 posts

Everytime I go to install it, it says...

"Microsoft strongly recommends you download Service Pack 2"

Is there no direct link for service pack 1a?

#6
Guest_usetobe_*

Posted 21 May 2005 - 04:50 PM

Guest

Try here

SP1a

#7
Lava Luke

Posted 21 May 2005 - 05:06 PM

New Member

Topic Starter
Member
7 posts

No that still leads me onto SP2.

#8
Guest_usetobe_*

Posted 22 May 2005 - 12:31 AM

Guest

Try these links:

Link 1

Link 2

Link 3

I've checked all 3 and they work for me

#9
Lava Luke

Posted 22 May 2005 - 08:39 AM

New Member

Topic Starter
Member
7 posts

Thanks for the links, I used the first one and it worked OK. Here's my HiJackThis log after I installed the service pack then re-booted;

Logfile of HijackThis v1.99.1
Scan saved at 15:35:21, on 22/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\mfcnn32.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\ICO.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\javadz32.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\System32\pd33.exe
C:\WINDOWS\isrvs\desktop.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\NORTON~2\navapw32.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe
C:\Program Files\DV Series\Console\Watch.exe
c:\windows\system32\cjjtht.exe
C:\Documents and Settings\luke\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {B4D6D604-7027-8569-0205-60E088EDCC69} - C:\WINDOWS\system32\ntko.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRA~1\YOURSI~1\ysb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eanth_critical_update_alert] C:\PROGRA~1\ACCELE~1\ANTI-V~1\EANTH_~1.EXE /Startup
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [javadz32.exe] C:\WINDOWS\javadz32.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\System32\pd33.exe
O4 - HKLM\..\Run: [RSync] C:\WINDOWS\System32\netsync.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~2\Cfgwiz.exe /R
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~2\navapw32.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\ares.exe" -h
O4 - HKCU\..\Run: [SpywareNo] C:\Program Files\SpywareNo\SpywareNo.exe
O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\System32\pd33.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Ulead Photo Express Calendar Checker For My Custom Edition.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe
O4 - Global Startup: Watch.lnk = C:\Program Files\DV Series\Console\Watch.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com
O15 - Trusted Zone: *.addictivetechnologies.com (HKLM)
O15 - Trusted Zone: *.addictivetechnologies.net (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.c4tdownload.com (HKLM)
O15 - Trusted Zone: *.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.f1organizer.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.megapornix.com (HKLM)
O15 - Trusted Zone: *.overpro.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted Zone: *.topconverting.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\mfcnn32.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe

#10
Guest_usetobe_*

Posted 22 May 2005 - 09:33 AM

Guest

Hi lavaluke,

Well it's all come out of the woodwork with that last log, you have several nasty infections all rolled into one PC. This will involve quite a bit of work and several procedures.

Prior to doing anything i would like you to prepare first by downloading quite a few programs.

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document AND print it for reference later.

This will likely be a few step process in removing the malware that has infected your system. I encourage you to stick with it and follow my directions as closely as possible so as to avoid complicating the problem further.

You have a nasty CoolWebSearch infection, Nail infection Ist infection and several others. First we will need to download a few tools that will help us in the removal of your problem.

In ADD/REMOVE in control panel, uninstall Spywareno as that is rogue spyware that is ineffective.

Also uninstall Microsoft Antispyware as that will interfere with what we need to do and reinstall nasties that we remove. You can reinstall it after we have finished everything

Please download the following two programs. Install them and update them both. Then run each one and have them fix anything that they may find.

Spybot Search and Destroy 1.3

Ad-aware S E 1.5

Download about:buster by RubbeRDuckY Here.
Download CWShredder Here.
Download SpSeHjfix Here.
Download and install CleanUp! Here

Please download Nailfix from here:
http://users.pandora...chy/nailfix.zip
Unzip it to the desktop but please do NOT run it yet.

Download a free 14 day trial of ewido from the link below. Install it and start it up. Follow the prompts to upgrade it, then close it down.

ewido

Right-Click HERE and Save As to download DelDomains.inf to your desktop, but do not run it yet.

Set PC to show hidden files (click link if you do not know how)LINK

Save all of these files somewhere you will remember like to the Desktop.

Please run an on-line virus scan at Kaspersky OnLine Scan or if that doesnt work, you can use TrendMicro or BitDefender. (Please post the results of the scan(s) in your next reply)

Unzip SpSeHjfix to its own folder (ie c:\SpSeHjfix)

Run the CleanUp! installer. You dont need to do anything with it right now.

Update About:Buster

Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
Click "OK" at the prompt with instructions.
Click "Update" and then "Check For Update" to begin the update process.
If any updates exist please download them by clicking "Download Update" then click the X to close that window.
Now close About:Buster

Update CWShredder

Open CWShredder and click I AGREE
Click Check For Update
Close CWShredder

Click Start > Run > and type in:

services.msc

Click OK.

In the services window find System Startup Service.
Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK.

In the same service window locate: Service: ZESOFT - Unknown owner
Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK.

Then in the same service window locate Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I)
Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK. Exit the Services utility.

Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Once in Safe Mode, please double-click on Nailfix.bat. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Please run about:buster by RubbeRDuckY:

Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
Click Yes to allow it to shutdown explorer.exe.
It will begin to check your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
When it has finished, click Save Log. Make sure you save it as I may need a copy of it later.
Reboot your computer into safe mode again

Run about:buster again following the same instructions as above, this time without the restart at the end

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.

Now run SpSeHjfix. A log will be saved in the same folder that you put the exe into. Please post the results of that log in your next reply.

Now run Ewido. click on the Scanner button, Select drives if you have more than one and then start.

grab a cup of coffee, sandwiches, book as this may take some time. Once the first problem is detected ensure you tick the box for all (bottom left) and allow it to continue.

At the end of the scan, it may ask if you would like to delete anything found in archive or zipped files, OK that request, then click on save report. SAVE to the default location, it will then generate a text file. Copy that to post in this thread.

Now scan with HJT and check the following entries if they are there. Some may have been removed by earlier procedures.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cdqgh.dll/sp.html#22776
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: (no name) - {B4D6D604-7027-8569-0205-60E088EDCC69} - C:\WINDOWS\system32\ntko.dll
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRA~1\YOURSI~1\ysb.dll
O4 - HKLM\..\Run: [javadz32.exe] C:\WINDOWS\javadz32.exe
O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\System32\pd33.exe
O4 - HKLM\..\Run: [RSync] C:\WINDOWS\System32\netsync.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\System32\pd33.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.c4tdownload.com (HKLM)
O15 - Trusted Zone: *.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.f1organizer.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.megapornix.com (HKLM)
O15 - Trusted Zone: *.overpro.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted Zone: *.topconverting.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\mfcnn32.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe

Ensure no windows open except HJT and click FIX CHECKED.

now using windows explorer locate the following files/folders and delete them.

C:\WINDOWS\Nail.exe
C:\WINDOWS\system32\ntko.dll
C:\PROGRA~1\YOURSI~1\ysb.dll
C:\WINDOWS\javadz32.exe
C:\WINDOWS\System32\pd33.exe
C:\WINDOWS\System32\netsync.exe
C:\WINDOWS\isrvs <<<<<<<<<<<<---ENTIRE FOLDER
c:\program files\180solutions\sais.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\System32\pd33.exe
C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
C:\WINDOWS\system32\mfcnn32.exe
C:\WINDOWS\svcproc.exe
C:\WINDOWS\zeta.exe
C:\WINDOWS\system32\mfcnn32.exe
c:\windows\system32\cjjtht.exe

RIGHT-CLICK DelDomains.inf on your desktop and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.

Now run CleanUp!. Click CleanUp and allow it to delete all the temporary files.

Reboot normally

Carry out another HJT scan and post the log back here, together with the other logs you saved, so we can see what is left to do

#11
Lava Luke

Posted 22 May 2005 - 02:33 PM

New Member

Topic Starter
Member
7 posts

WOW! I can see this is going to take a long time, but I guess it will be worth it in the end. Once again thanks for the help.

I've started the Kaspersky OnLine Scan and it seems to be running OK if a little slow. But I haven't been able to download the 'CleanUp!' thing as I get a 'HTTP 404 Not Found' error page come up, any other ways of getting it as I can see I will need to run it soon.

Luke :tazz:

#12
Lava Luke

Posted 22 May 2005 - 07:10 PM

New Member

Topic Starter
Member
7 posts

Not sure if this is the right way to post it, but this is the result from the Kaspersky Online Scan...

C:\Documents ...BargainsBuddy.zip Passwor...tected-EXE send delete
C:\Documents ...ttings\Temp\1.exe Trojan-...2.Agent.nj send delete
C:\Documents ...224093\build3.exe Trojan-...32.Ieser.a send delete
C:\Documents ...tings\Temp\bb.exe Trojan-...2.Adload.a send delete
C:\Documents ...mp\GLF50GLF50.EXE Trojan-...TSUpdate.j send delete
C:\Documents ...ngs\Temp\II68.tmp Trojan-...2.Agent.nj send delete
C:\Documents ...ngs\Temp\IIC2.tmp Trojan-...2.Agent.nj send delete
C:\Documents ...Temp\iinstall.exe Trojan-....IstBar.ji send delete
C:\Documents ...gs\Temp\nse68.tmp Trojan-....IstBar.ji send delete
C:\Documents ...gs\Temp\nsz83.tmp Trojan-....IstBar.jj send delete
C:\Documents ...p\targetsaver.exe Trojan-...TSUpdate.j send delete
C:\Documents ...l_4_0_3_8_b17.exe Trojan-...TSUpdate.k send delete
C:\Documents ...wer_remove[1].exe Trojan-....IstBar.gi send delete
C:\Documents ...HEL\istsvc[1].exe Trojan-...IstBar.gen send delete
C:\Documents ...F\sidefind[1].exe Trojan-....IstBar.jd send delete
C:\Documents ...LBKX872\bb[1].exe Trojan-...2.Adload.a send delete
C:\Documents ...ttings\Temp\1.exe Trojan-...2.Agent.nj send delete
C:\Documents ...224093\build3.exe Trojan-...32.Ieser.a send delete
C:\Documents ...tings\Temp\bb.exe Trojan-...2.Adload.a send delete
C:\Documents ...\eied_s7_c_77.exe Trojan-...Mediket.ag send delete
C:\Documents ...Temp\iinstall.exe Trojan-....IstBar.ji send delete
C:\Documents ...iles\Q3567836.exe Trojan-...2.Small.dq send delete
C:\efvefefe.exe Trojan-....IstBar.it send delete
C:\eied_s7.cab Trojan-...Mediket.ag send delete
C:\pd33.exe Trojan-...2.Small.rd send delete
C:\Program Fi...0509491732681.asw Trojan-...32.Ieser.a send delete
C:\Program Fi...orer\nwclxcny.exe Trojan-...32.Delf.cb send delete
C:\Program Fi...plorer\rbwxka.exe Trojan-...32.Delf.cb send delete
C:\Program Fi...plorer\tniwva.exe Trojan-...32.Delf.cb send delete
C:\Program Fi...plorer\update.exe Trojan-...glieder.at send delete
C:\Program Fi...orer\yryvibpj.exe Trojan-...32.Delf.cb send delete
C:\Program Fi...-4B53-AE10-65D90C Trojan-....IstBar.gi send delete
C:\Program Fi...-41DE-BC82-5B9096 Trojan-....IstBar.jd send delete
C:\Program Fi...-4A0B-ACEF-0B7107 Trojan-....IstBar.jd send delete
C:\Program Fi...-4A62-9310-98C7F2 Trojan-....IstBar.jd send delete
C:\Program Fi...-40E7-A564-048D15 Trojan-....IstBar.jd send delete
C:\Program Fi...-480A-94F3-C56ADF Trojan-....IstBar.jd send delete
C:\Program Fi...\wmplayer.exe.tmp Virus.Win32.Bube.l send delete
C:\WINDOWS\addbi32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\addlm.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\addpu.dll Trojan-...2.Agent.al send delete C:\WINDOWS\addzv32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\addzz32.exe Trojan....2.Agent.bi send delete
C:\WINDOWS\apifx32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\apijz.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\apipu.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\apirr32.exe Trojan-...2.Agent.ap send delete
C:\WINDOWS\apitu.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\apivj.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\apivw.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\appby32.dll Trojan....2.Agent.bi send delete
C:\WINDOWS\appcb32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\apphg.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\appkz32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\appvk.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\appvm32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\atlar.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\atlds32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\atlgz.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\atlsp32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\atluj32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\atlwk32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\atlxk32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\atlyr.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\crao32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\crev32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\crfu.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\crhi.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\crnp32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\crqk.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\crsq.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\crtt32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\cryi32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\crzt.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\d3bp32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\d3ey.dll Trojan-...2.Agent.ap send delete
C:\WINDOWS\d3fb32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\d3fi32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\d3gc32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\d3ih.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\d3ja.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\d3ju.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\d3jy32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\d3me32.exe Trojan-...2.Agent.ap send delete
C:\WINDOWS\d3qv.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\d3qx32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\d3sp32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\d3ta.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\d3xi.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\d3xr.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\d3yv.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\delete.exe Trojan-...2.Small.or send delete
C:\WINDOWS\Do...ONFLICT.1\mp3.ocx Trojan-...2.Agent.ex send delete
C:\WINDOWS\Do....1\ysbactivex.dll Trojan-...IstBar.gen send delete
C:\WINDOWS\Do...ONFLICT.2\mp3.ocx Trojan-...2.Agent.ex send delete
C:\WINDOWS\Do...ONFLICT.3\mp3.ocx Trojan-...2.Agent.ex send delete
C:\WINDOWS\Do...ONFLICT.4\mp3.ocx Trojan-...2.Agent.ex send delete
C:\WINDOWS\Do...ONFLICT.5\mp3.ocx Trojan-...2.Agent.ex send delete
C:\WINDOWS\Do...ram Files\mp3.ocx Trojan-...2.Agent.ex send delete
C:\WINDOWS\Do...es\ysbactivex.dll Trojan-...IstBar.gen send delete
C:\WINDOWS\explorer.new Virus.Win32.Bube.l send delete
C:\WINDOWS\iedu32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\ieek.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\iees32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\iegi32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ieif.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\iekr.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\iepg32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\ierl32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ievu.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\ipcv32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\ipez.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\ipez32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ipnz32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ipsn32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ipum.exe Trojan-...2.Agent.ap send delete
C:\WINDOWS\ipyq32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\isrvs\edmond.exe Trojan.....Delprot.a send delete
C:\WINDOWS\isrvs\sysupd.dll Trojan-...32.Ieser.a send delete
C:\WINDOWS\javabi.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\javadm32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\javafb.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\javagk32.exe Trojan-...2.Agent.ap send delete
C:\WINDOWS\javajl32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\javajv.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\javaky32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\javand32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\javank32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\javanl32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\javape32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\javaqc.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\javavj32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfcan.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfcch.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfccz32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfcdw.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfcgm32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfchl32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfchn32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\mfcie.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfckn.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfclu.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfcmh.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\mfcnw.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfcqr32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mfcrq.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\mscq.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\msek32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\msmt.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mspj.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\msrb32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\msrd.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\msrp.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mssz32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mstj32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\mswq.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\mszm.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\netaq32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\netdv.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\netga32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\netgd32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\netgv32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\nethl.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\netlg32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\netlk32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\netnd.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\netqn.exe Trojan....2.Agent.bi send delete
C:\WINDOWS\netrb.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\netwa.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\netxu32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\netyy32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntcg32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\ntek32(10).dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntek32(2).dll Trojan-...2.Agent.bq send delete C:\WINDOWS\ntek32(3).dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntek32(4).dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntek32(5).dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntek32(6).dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntek32(7).dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntek32(8).dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntek32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntgp.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\nthc32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\ntms.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\nttc.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntvm32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\ntwt32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\ntxq32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sdkcm.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sdkdy32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sdkfd.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sdklo32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\sdknd.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sdkvt32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sdkxc.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sdkxl32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sdkzm.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\svcproc.exe Trojan.....Stervis.c send delete
C:\WINDOWS\sysio32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\sysjh.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\syskm.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sysqu.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\sysrg.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\syssf32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\syssq.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\addhe.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\addmb.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\addyb.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\addzf32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\apihd32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\apixs32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\apphg32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\appvd.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\appxl32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\atlfd32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\atlkp.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\atlli.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\atlma32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\atlmk32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\atlou32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\atlza32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\atlzp32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\atlzz32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\boln.dll Trojan-...2.Druser.b send delete
C:\WINDOWS\system32\corelsys.dll Trojan-...2.Agent.ba send delete
C:\WINDOWS\system32\crcs32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\crft.exe Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\crij.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\crkw.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\crnh32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\cron32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\croq.dll Trojan-...2.Agent.an send delete
C:\WINDOWS\system32\crqy32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\crtt.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\crvy32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\crxb.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\d3ez.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\d3jm32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\d3nz.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\d3qi.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\d3yl32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\d3yu32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sy...ivers\delprot.sys Trojan.....Delprot.a send delete
C:\WINDOWS\system32\efvefefe.exe Trojan-....IstBar.it send delete
C:\WINDOWS\system32\iedi32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\iejh32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ielc.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ieqy32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\iern.exe Trojan....2.Agent.bi send delete
C:\WINDOWS\system32\iesz32.dll Trojan-...2.Agent.an send delete
C:\WINDOWS\system32\ieti.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\ieuh.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\iphd32.dll Trojan....2.Agent.bi send delete
C:\WINDOWS\system32\iphz32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\ipix.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ipkk.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ipmi32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ipot.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ipsh.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ipxf32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\javaax.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\javaby32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\javato.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\javatw.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\javawx32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\javayx32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\mfcew.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\mfcfc32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\mfcmb32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\mfcnl.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\mfcnv.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\mfcqq.exe Trojan....2.Agent.bi send delete
C:\WINDOWS\system32\mfcro32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\mfcry32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\mfcuz.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\mfcwe.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\mfcxh.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\msdc.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\msdl.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\mslz32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\mspb32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\msus32.exe Trojan-...2.Agent.ap send delete
C:\WINDOWS\system32\netcd32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\netgg.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\netkk.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\netsq32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\nettt.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\netwb.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ntay32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\ntcy32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ntgf32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ntgl.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\nthf.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ntjf.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ntko.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ntnm.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\ntqy.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ntrh32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\nttb.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\ntxc32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\pd33.exe Trojan-...2.Small.rd send delete
C:\WINDOWS\system32\real32.exe Trojan-...glieder.as send delete
C:\WINDOWS\system32\realupd.exe Trojan-...glieder.at send delete
C:\WINDOWS\sy...m32\realupd32.exe Trojan-...glieder.at send delete
C:\WINDOWS\system32\sdkas.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\sdkbd.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\sdkft.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\sdkoh32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\sdkqx.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\svhost.exe Virus.Win32.Bube.l send delete
C:\WINDOWS\system32\sysfg.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\sysjg32.dll Trojan....2.Agent.bi send delete
C:\WINDOWS\system32\sysnd32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\syspz32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\sysrj.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\sysrt32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\syssy32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\sy...32\telnet.exe.tmp Virus.Win32.Bube.l send delete
C:\WINDOWS\system32\video2.exe Trojan-...2.Small.rd send delete
C:\WINDOWS\system32\winbz.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\wineu32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\wingc.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\wingk.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\wingq32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\winli32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\winok.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\winqg32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\winsf32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\system32\wintb32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\winuk.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\winwg.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\winyo.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\system32\winzv32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\sysvy.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\telnet.exe Virus.Win32.Bube.l send delete
C:\WINDOWS\TEMP\1.tmp Trojan....HideProc.a send delete
C:\WINDOWS\winal32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\wincv.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\wincw.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\winjb32.dll Trojan-...2.Agent.al send delete
C:\WINDOWS\winjr.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\winqi32.dll Trojan-...2.Agent.bq send delete
C:\WINDOWS\wintg32.exe Trojan-...2.Agent.bq send delete
C:\WINDOWS\winwt.dll Trojan-...2.Agent.bq send delete

#13
Guest_usetobe_*

Posted 25 May 2005 - 07:57 AM

Guest

New HJT log please.

#14
Guest_usetobe_*

Posted 21 June 2005 - 04:21 PM

Guest

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.