[Solved]Help needed!!!

Unknown · November 2006

Hi,
My computer is infected with so many things its unreal! I opened something on msn msgr and it in stalled 888 toolbar since then the computer has been going crazy. I have done all the steps in the sticky thread but my computer keeps shutting down when i try to install windows updates? i dont know if 888 toolbar is completely gone but it is not showing in add/remove programs anymore. Your help would be amazing here is my hjthis log.

Logfile of HijackThis v1.99.1
Scan saved at 01:10:02, on 30/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Jessops\Picture Suite\InsDetect.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [explorer] C:\WINDOWS\system32\winstall.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Jessops Insert Detect] C:\Program Files\Jessops\Picture Suite\InsDetect.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by113fd.bay113.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dontstayin.com/misc/ActiveX_4_0_50/ImageUploader4.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

Activescan

Incident Status Location

Virus:trj/torpig.a Disinfected C:\WINDOWS\Temp\$_2341235.TMP
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\User\Cookies\user@tribalfusion[1].txt
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\User\Cookies\user@adtech[2].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\User\Cookies\user@mediaplex[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\User\Cookies\user@doubleclick[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\User\Cookies\user@com[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\User\Cookies\user@atdmt[2].txt
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc192\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc193\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc194\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc195\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc196\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc197\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc198\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc199\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc200\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc201\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc202\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc204\UnInstall.exe
Adware:Adware/Mytoolbar Not disinfected C:\Recycled\Dc205\UnInstall.exe
Kasper Sky Log

KASPERSKY ONLINE SCANNER REPORT
Thursday, November 30, 2006 12:00:41 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 30/11/2006
Kaspersky Anti-Virus database records: 246781

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 70074
Number of viruses found 9
Number of infected objects 134 / 0
Number of suspicious objects 0
Duration of the scan process 00:49:00

Infected Object Name Virus Name Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{0AD9300D-681B-4E0C-86E3-C8A18E241C41}.bin Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2006-11-29_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\User\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\User\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\User\Local Settings\Temp\~DFFEF1.tmp Object is locked skipped

C:\Documents and Settings\User\Local Settings\Temp\Temporary Internet Files\Content.IE5\Y5WF25I5\adv644[1].htm Infected: Trojan-Downloader.JS.Agent.ab skipped

C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\History\History.IE5\MSHist012006112920061130\index.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\dbeam Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\dbeao Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\dbdam Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\dbdao Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\dbu2d.ht1 Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\dbc2e.ht1 Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\dbvmh.ht1 Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\dbvm.cf1 Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\dbm Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\fiih.ht1 Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\fii.cf1 Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\rpmh.ht1 Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\rpm.cf1 Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\hpt2i.ht1 Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Google\Google Desktop Search\hp Object is locked skipped

C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\User\Application Data\Teleca\Telecalib\Logging\Application logs\SpecificUSB_log.txt Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPStart.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPPolicy.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPStop.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Program Files\Common Files\{320D180E-06C5-1033-0903-05033120002c}\system.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\Portal\62DE263A.exe Object is locked skipped

C:\Program Files\Norton AntiVirus\Quarantine\Portal\4E48702C.exe Object is locked skipped

C:\Program Files\Norton AntiVirus\Quarantine\27634242.DLL Infected: Trojan-PSW.Win32.Sinowal.bh skipped

C:\Program Files\Norton AntiVirus\Quarantine\14700366.dll Infected: Trojan-PSW.Win32.Sinowal.bh skipped

C:\Program Files\Norton AntiVirus\Quarantine\1F6B3950.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\284432B7.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28485CB4.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\284B06B0.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\284E30AD.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28515AA9.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\285504A5.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28582EA2.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\285B589E.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\285E029B.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28622C97.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28655693.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28680090.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\286B2A8C.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\286F5489.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28727E85.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28752882.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\2879527E.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\287C7C7A.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\287F2677.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28825073.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28867A70.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\2889246C.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\288C4E68.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\288F7865.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28964C5E.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\2899765A.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\289C2056.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28A04A53.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28A3744F.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28A61E4C.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28AA4848.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28AD7244.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28B01C41.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28B3463D.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28B7703A.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28BA1A36.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28BD4432.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28C06E2F.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28C4182B.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\28C74228.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\14832C3F.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\4B012ECE.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\296D1F70.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\5A4C0A3E.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\734C3E25.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\398129E6.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\2971496D.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\2014683D.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\1B964D7C.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\45A91E77.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\4F3B4DD5.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\18053D6E.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\29747369.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\65DC463C.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\43E15CD2.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\51D21308.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\0FBB35D1.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\Program Files\Norton AntiVirus\Quarantine\601A0F46.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\Program Files\Norton AntiVirus\Quarantine\62DE263A.exe Infected: Trojan-Downloader.Win32.Tiny.bw skipped

C:\Program Files\Norton AntiVirus\Quarantine\4E48702C.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\Program Files\Norton AntiVirus\Quarantine\575F0806.exe Infected: IM-Worm.Win32.Licat.h skipped

C:\Program Files\Norton AntiVirus\Quarantine\5A720EA4.exe Infected: IM-Worm.Win32.Licat.h skipped

C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015212.exe Infected: IM-Worm.Win32.Licat.h skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015213.exe Infected: not-a-virus:AdWare.Win32.PurityScan.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015224.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015225.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015226.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015227.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015228.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015229.exe Infected: Trojan.Win32.Regger.s skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015231.exe Infected: IM-Worm.Win32.Licat.h skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015234.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015238.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015242.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015246.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015276.exe Infected: Trojan-Downloader.Win32.Small.on skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0016211.exe Infected: not-a-virus:AdWare.Win32.PurityScan.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0016212.exe Infected: not-a-virus:AdWare.Win32.PurityScan.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0016226.exe Infected: not-a-virus:AdWare.Win32.PurityScan.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016285.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016288.exe Infected: not-a-virus:AdWare.Win32.PurityScan.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016298.DLL Infected: Trojan-PSW.Win32.Sinowal.bh skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016299.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016315.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016323.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016326.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016330.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016340.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016344.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016349.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016353.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016357.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016371.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016375.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016380.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016384.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016388.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016392.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016397.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016401.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016405.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016409.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016413.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016418.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016421.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016424.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016459.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016464.exe Infected: not-a-virus:AdWare.Win32.PurityScan.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016500.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016501.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016502.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016503.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016504.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016505.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016506.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016507.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016508.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016509.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016510.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016511.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016512.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016513.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016514.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016515.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016516.dll Infected: not-a-virus:AdWare.Win32.Softomate.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016536.exe Infected: not-a-virus:AdWare.Win32.PurityScan.u skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016538.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016539.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016540.exe Infected: not-a-virus:AdTool.Win32.WhenU.a skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016541.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016542.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016543.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016544.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016545.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016546.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016547.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016548.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016549.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016550.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016551.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016552.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016553.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016554.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016555.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016556.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016557.exe Object is locked skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP141\A0017684.exe Infected: IM-Worm.Win32.Licat.h skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP141\A0017688.exe Infected: IM-Worm.Win32.Licat.h skipped

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP141\change.log Object is locked skipped

D:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP141\change.log Object is locked skipped

Scan process completed.

Plz Help!!!!

Trogan · December 2006

Hi steveobrady, welcome to Short-Media Forums!

You have two anti-virus programs running (AVG and Norton). That is not a good idea as multiple anti-virus programs can conflict and cause more problems. You need to uninstall one of them through Add/Remove programs.
_______________________

Run Hijackthis.
Click on Open the Misc Tools section.
Next click on Open uninstall manager.
Press the Save list button.
Save the file to your desktop, with the default name of uninstall_list
Copy & Paste the entire contents of that file in your in your next post.

Please post the Uninstall list back here, along with a new HijackThis log.

steveobrady · December 2006

Acer eManager for Notebook
Acer ePowerManagement
Ad-Aware SE Personal
Adobe Reader 7.0
Adobe Shockwave Player
Apple Software Update
ccCommon
EPSON Attach To Email
EPSON Easy Photo Print
EPSON File Manager
EPSON Print CD
EPSON Printer Software
EPSON Scan Assistant
EPSON Web-To-Page
ESPR220 User's Guide
Google Toolbar for Internet Explorer
HDAUDIO Soft Data Fax Modem with SmartCP
High Definition Audio Driver Package - KB888111
Hijackthis 1.99.1
HijackThis 1.99.1
igLoader 2,0,0,2
Intel(R) Graphics Media Accelerator Driver for Mobile
Internet Worm Protection
iPod Update 2004-04-28
IrfanView (remove only)
iTunes
J2SE Runtime Environment 5.0 Update 3
Kaspersky Online Scanner
Launch Manager
LiveReg (Symantec Corporation)
LiveUpdate 3.0 (Symantec Corporation)
Macromedia Flash Player 8
MAGIX audio cleaning lab 2005 deLuxe
Microsoft .NET Framework 1.1
Microsoft Office Professional Edition 2003
Norton AntiVirus 2005
Norton AntiVirus 2005 (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton WMI Update
NTI Backup NOW! 4
NTI CD & DVD-Maker
PIF DESIGNER
Pinnacle Hollywood FX for Studio
PowerDVD
QuickTime
RealPlayer
REALTEK Gigabit and Fast Ethernet NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB925486)
SmartSound Quicktracks Plugin
Sony ACID 4.0f
Sony Ericsson PC Suite 1.20.224
SPBBC
Spybot - Search & Destroy 1.4
SpywareBlaster v3.5.1
Studio 9
Symantec
Symantec Script Blocking Installer
SymNet
Synaptics Pointing Device Driver
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB908531)
Update for Windows XP (KB916595)
WinAce Archiver
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859

Trogan · December 2006

The uninstall log looks complete to me. Can you confirm that is it the whole log?

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

Do not run a scan yet. We will later!
_________________________________________

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
This program is for XP and Windows 2000 only!

Do not run it yet. We will later!
_________________________________________

Open HijackThis
- Click the Do a system scan only button
- Check the following entries (below)

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [explorer] C:\WINDOWS\system32\winstall.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

- Close ALL open windows (especially Internet Explorer!)
- Click Fix Checked
Close HiajckThis
_________________________________________

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

_________________________________________

Do all of the following in Safe Mode until instructed to go back to Normal Mode

Find and delete the following Files in RED

C:\WINDOWS\system32\winstall.exe

Find and delete the following Folders in RED

C:\Program Files\LimeWire
_________________________________________

Open ATF Cleaner.exe that you downloaded earlier

Under Main select the following:

Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache*The other boxes are optional*
Then click the Empty Selected button.

Click Exit on the Main menu to close the program.
_________________________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

Click on Scanner on the toolbar.
Click on the Settings tab.
- Under How to act?
  - Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
  - All checkboxes should be ticked.
- Under Possibly unwanted software:
  - All checkboxes should be ticked.
- Under Reports:
  - Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
  - Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes

. Reboot back into Normal Mode
_________________________________________

1. Download this file to your Desktop - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
_________________________________________

Please post the following:

1) AVG anti-spyware log
2) ComboFix log
3) New HijackThis log
4) New Uninstall log

You may need serveral posts so the logs do not get cut off

steveobrady · December 2006

AVG Anti-Spyware - Scan Report

+ Created at: 00:42:17 08/12/2006

+ Scan result:

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015213.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0016211.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0016212.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0016226.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016288.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016464.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016536.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\Program Files\Common Files\{320D180E-06C5-1033-0903-05033120002c}\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015224.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015225.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015226.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015227.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015228.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015234.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015238.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015242.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015246.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016285.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016299.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016315.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016323.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016326.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016330.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016340.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016344.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016349.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016353.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016357.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016371.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016375.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016380.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016384.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016388.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016392.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016397.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016401.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016405.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016409.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016413.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016418.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016421.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016424.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016459.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016500.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016501.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016502.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016503.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016504.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016505.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016506.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016507.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016508.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016509.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016510.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016511.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016512.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016513.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016514.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016515.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP140\A0016516.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP158\A0034810.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049142.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049148.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049152.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049157.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049160.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049170.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049175.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049176.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049177.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049178.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049179.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049180.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049181.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049182.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049184.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049186.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049187.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049188.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049189.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049190.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049191.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049192.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049193.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049194.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049196.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049461.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049463.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049465.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049466.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049467.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049468.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049469.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049470.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049471.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049472.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049473.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049475.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049476.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049477.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049478.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049479.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049480.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049481.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049482.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049483.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049485.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049486.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049487.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049488.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049489.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049490.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049492.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049493.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049494.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049495.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049496.exe -> Downloader.Small.on : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP158\A0034811.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049134.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049135.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049136.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049137.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049138.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049139.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049140.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049141.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049143.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049144.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049145.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049146.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049147.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049149.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049150.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049151.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049153.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049154.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049155.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049156.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049158.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049159.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049161.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049162.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049163.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049164.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049165.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049166.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049167.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049168.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049169.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049171.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049172.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049173.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049174.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049183.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049185.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049195.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049197.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049198.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049199.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049200.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049201.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049202.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049203.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049204.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049205.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049206.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049207.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049208.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049209.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049210.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049211.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049212.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049213.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049214.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049215.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049216.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049217.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049218.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049219.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049220.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049221.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049222.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049223.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049224.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049225.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049226.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049227.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049228.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049229.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049230.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049231.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049232.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049233.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049234.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049235.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049236.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049237.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049238.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049239.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049240.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049241.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049242.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049243.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049244.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049245.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049246.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049247.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049248.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049249.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049250.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049251.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049252.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049253.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049254.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049255.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049256.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049257.e

steveobrady · December 2006

C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049258.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049259.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049260.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049261.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049262.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049263.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049264.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049265.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049266.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049267.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049268.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049269.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049270.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049271.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049272.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049273.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049274.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049275.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049276.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049277.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049278.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049279.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049280.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049281.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049282.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049283.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049284.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049285.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049286.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049287.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049288.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049289.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049290.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049291.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049292.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049293.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049294.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049295.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049296.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049297.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049298.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049299.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049300.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049301.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049302.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049303.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049304.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049305.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049306.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049307.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049308.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049309.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049310.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049311.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049312.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049313.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049314.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049315.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049316.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049317.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049318.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049319.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049320.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049321.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049322.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049323.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049324.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049325.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049326.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049327.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049328.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049329.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049330.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049331.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049332.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049333.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049334.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049335.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049336.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049337.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049338.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049339.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049340.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049341.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049342.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049343.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049344.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049345.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049346.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049347.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049348.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049349.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049350.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049351.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049352.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049353.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049354.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049355.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049356.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049357.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049358.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049359.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049360.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049361.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049362.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049363.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049364.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049365.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049366.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049367.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049368.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049369.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049370.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049371.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049372.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049373.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049374.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049375.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049376.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049377.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049378.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049379.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049380.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049381.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049382.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049383.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049384.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049385.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049386.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049387.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049388.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049389.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049390.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049391.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049392.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049393.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049394.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049395.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049396.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049397.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049398.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049399.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049400.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049401.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049402.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049403.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049404.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049405.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049406.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049407.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049408.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049409.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049410.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049411.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049412.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049413.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049414.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049415.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049416.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049417.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049418.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049419.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049420.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049421.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049422.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049423.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049424.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049425.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049426.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049427.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049428.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049429.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049430.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049431.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049432.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049433.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049434.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049435.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049436.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049437.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049438.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049439.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049440.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049441.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049442.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049443.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049444.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049445.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049446.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049447.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049448.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049449.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049450.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049451.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049452.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049453.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049454.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049455.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049456.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049457.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049458.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049459.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049460.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049462.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049464.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049474.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049484.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049491.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049497.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049498.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049499.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049500.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049501.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049502.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049503.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049504.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049505.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049506.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).

steveobrady · December 2006

58C678D49ACB}\RP169\A0049507.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049508.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049509.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049510.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049511.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049512.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049513.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049514.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049515.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049516.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049517.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049518.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049519.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049520.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049521.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049522.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049523.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049524.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049525.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049526.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049527.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049528.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049529.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049530.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049531.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049532.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049533.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049534.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049535.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049536.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049537.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049538.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049539.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049540.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049541.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049542.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049543.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049544.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049545.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049546.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049547.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049548.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049549.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049550.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049551.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049552.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049553.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049554.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049555.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049556.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049557.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049558.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049559.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049560.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049561.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049562.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049563.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049564.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049565.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049566.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049567.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049568.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049569.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049570.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049571.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049572.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049573.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049574.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049575.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049576.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049577.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049578.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049579.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049580.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049581.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049582.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049583.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049584.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049585.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049586.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049587.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049588.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049589.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049590.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049591.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049592.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049593.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049594.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049595.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049596.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049597.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049598.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049599.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049600.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049601.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049602.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049603.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049604.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049605.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049606.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049607.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049608.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049609.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049610.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049611.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049612.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049613.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049614.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049615.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049616.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049617.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049618.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049619.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049620.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049621.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049622.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049623.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049624.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049625.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049626.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049627.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049628.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049629.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049630.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049631.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049632.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049633.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049634.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049635.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049636.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049637.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049638.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049639.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049640.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049641.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049642.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049643.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049644.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049645.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049646.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049647.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049648.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049649.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049650.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049651.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049652.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049653.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049654.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049655.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049656.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049657.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049658.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049659.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049660.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049661.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049662.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049663.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049664.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049665.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049666.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049667.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049668.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049669.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049670.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049671.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049672.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049673.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049674.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049675.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049676.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049677.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049678.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049679.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049680.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049681.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049682.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049683.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049684.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049685.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049686.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049687.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049688.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049689.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049690.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049691.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049692.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049693.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049694.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049695.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049696.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049697.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049698.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049699.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049700.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049701.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049702.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049703.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049704.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049705.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049706.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049707.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049708.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049709.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049710.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049711.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049712.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049713.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049714.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049715.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049716.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049717.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049718.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049719.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049720.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049721.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049722.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049723.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049724.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049725.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049726.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049727.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049728.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049729.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049730.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049731.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049732.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049733.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049734.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049735.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049736.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049737.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049738.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049739.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049740.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049741.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049742.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049743.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049744.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049745.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049746.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049747.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049748.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049749.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049750.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049751.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049752.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049753.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049754.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049755.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049756.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049757.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049758.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049759.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049760.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049761.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049762.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049763.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049764.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049765.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049766.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049767.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049768.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049769.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049770.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049771.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049772.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049773.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049774.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049775.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049776.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049777.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049778.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049779.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049780.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049781.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049782.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049783.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049784.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049785.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049786.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049787.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049788.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049789.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049790.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049791.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049792.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049793.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049794.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049795.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049796.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049797.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049798.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049799.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049800.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049801.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049802.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049803.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049804.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049805.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049806.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049807.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049808.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049809.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049810.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP169\A0049811.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015212.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP138\A0015231.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016312.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016325.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP139\A0016347.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP141\A0017684.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP141\A0017685.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP141\A0017686.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP141\A0017687.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{38B4D61C-C07A-4C02-96D0-58C678D49ACB}\RP141\A0017688.exe -> Trojan.Small : Cleaned with backup (quarantined).

::Report end

steveobrady · December 2006

User - 06-12-08 0:51:39.21 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\User\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\{320D180E-06C5-1033-0903-05033120002c}

((((((((((((((((((((((((((((((( Files Created from 2006-11-08 to 2006-12-08 ))))))))))))))))))))))))))))))))))

2006-12-07 11:41 <DIR> d--hs---- C:\FOUND.021
2006-12-06 14:16 3,968 --a

C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-06 14:16 <DIR> d

C:\Program Files\Grisoft
2006-12-06 14:04 <DIR> d--hs---- C:\FOUND.020
2006-12-02 02:54 <DIR> d--hs---- C:\FOUND.019
2006-12-02 02:38 <DIR> d--hs---- C:\FOUND.018
2006-12-01 22:52 <DIR> d--hs---- C:\FOUND.017
2006-12-01 22:44 <DIR> d--hs---- C:\FOUND.016
2006-12-01 22:26 <DIR> d--hs---- C:\FOUND.015
2006-12-01 22:13 <DIR> d--hs---- C:\FOUND.014
2006-12-01 22:04 <DIR> d--hs---- C:\FOUND.013
2006-12-01 21:56 <DIR> d

C:\Documents and Settings\All Users\Application Data\Avg7
2006-12-01 21:41 <DIR> d--hs---- C:\FOUND.012
2006-12-01 21:33 <DIR> d--hs---- C:\FOUND.011
2006-12-01 13:39 <DIR> d--hs---- C:\FOUND.010
2006-12-01 13:32 <DIR> d--hs---- C:\FOUND.009
2006-12-01 03:37 <DIR> d--hs---- C:\FOUND.008
2006-12-01 03:18 <DIR> d--hs---- C:\FOUND.007
2006-12-01 03:09 <DIR> d--hs---- C:\FOUND.006
2006-11-30 02:46 <DIR> d--hs---- C:\FOUND.005
2006-11-30 01:42 <DIR> d--hs---- C:\FOUND.004
2006-11-30 01:31 <DIR> d--hs---- C:\FOUND.003
2006-11-30 01:03 <DIR> d

C:\Program Files\Hijackthis
2006-11-30 00:45 <DIR> d--hs---- C:\FOUND.002
2006-11-30 00:32 <DIR> d--hs---- C:\FOUND.001
2006-11-30 00:17 <DIR> d

C:\WINDOWS\Internet Logs
2006-11-30 00:07 <DIR> d--hs---- C:\FOUND.000
2006-11-29 21:58 <DIR> d

C:\WINDOWS\system32\Kaspersky Lab
2006-11-29 19:35 <DIR> d

C:\Program Files\SpywareBlaster
2006-11-29 18:35 <DIR> d

C:\Program Files\Spybot - Search & Destroy
2006-11-29 18:35 <DIR> d

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-11-29 18:28 <DIR> d

C:\Documents and Settings\User\Application Data\Lavasoft
2006-11-29 18:27 <DIR> d

C:\Program Files\Lavasoft
2006-11-29 14:41 <DIR> d--h

C:\WINDOWS\$hf_mig$
2006-11-29 14:41 <DIR> d

C:\WINDOWS\system32\PreInstall
2006-11-29 11:25 <DIR> d

C:\WINDOWS\system32\SoftwareDistribution
2006-11-17 01:30 <DIR> d

C:\Documents and Settings\User\Application Data\DivX
2006-11-17 01:18 <DIR> d

C:\Program Files\Mozilla Firefox
2006-11-17 01:18 <DIR> d

C:\Documents and Settings\User\Application Data\Mozilla
2006-11-17 01:17 <DIR> d

C:\Program Files\DivX

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"LaunchApp"="Alaunch"
"High Definition Audio Property Page Shortcut"="HDAShCut.exe"
"AzMixerSel"="C:\\Program Files\\Realtek\\InstallShield\\AzMixerSel.exe"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent"
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"RTHDCPL"="RTHDCPL.EXE"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"EPM-DM"="c:\\acer\\epm\\epm-dm.exe"
"ePowerManagement"="C:\\Acer\\ePM\\ePM.exe boot"
"LManager"="C:\\PROGRA~1\\LAUNCH~1\\QtZgAcer.EXE"
"eRecoveryService"="C:\\Program Files\\Acer\\eRecovery\\Monitor.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"EPSON Stylus Photo R220 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAIE.EXE /P30 \"EPSON Stylus Photo R220 Series\" /O6 \"USB001\" /M \"Stylus Photo R220\""
"PinnacleDriverCheck"="C:\\WINDOWS\\system32\\PSDrvCheck.exe -CheckReg"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
@=""
"Sony Ericsson PC Suite"="\"C:\\Program Files\\Sony Ericsson\\Mobile2\\Application Launcher\\Application Launcher.exe\" /startoptions"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - User.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Completion time: 06-12-08 0:52:19.95
C:\ComboFix.txt ... 06-12-08 00:52

steveobrady · December 2006

Logfile of HijackThis v1.99.1
Scan saved at 01:10:02, on 30/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Jessops\Picture Suite\InsDetect.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [explorer] C:\WINDOWS\system32\winstall.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Jessops Insert Detect] C:\Program Files\Jessops\Picture Suite\InsDetect.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by113fd.bay113.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dontstayin.com/misc/ActiveX_4_0_50/ImageUploader4.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

steveobrady · December 2006

Acer eManager for Notebook
Acer ePowerManagement
Ad-Aware SE Personal
Adobe Reader 7.0
Adobe Shockwave Player
Apple Software Update
ccCommon
EPSON Attach To Email
EPSON Easy Photo Print
EPSON File Manager
EPSON Print CD
EPSON Printer Software
EPSON Scan Assistant
EPSON Web-To-Page
ESPR220 User's Guide
Google Toolbar for Internet Explorer
HDAUDIO Soft Data Fax Modem with SmartCP
High Definition Audio Driver Package - KB888111
Hijackthis 1.99.1
HijackThis 1.99.1
igLoader 2,0,0,2
Intel(R) Graphics Media Accelerator Driver for Mobile
Internet Worm Protection
iPod Update 2004-04-28
IrfanView (remove only)
iTunes
J2SE Runtime Environment 5.0 Update 3
Kaspersky Online Scanner
Launch Manager
LiveReg (Symantec Corporation)
LiveUpdate 3.0 (Symantec Corporation)
Macromedia Flash Player 8
MAGIX audio cleaning lab 2005 deLuxe
Microsoft .NET Framework 1.1
Microsoft Office Professional Edition 2003
Norton AntiVirus 2005
Norton AntiVirus 2005 (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton WMI Update
NTI Backup NOW! 4
NTI CD & DVD-Maker
PIF DESIGNER
Pinnacle Hollywood FX for Studio
PowerDVD
QuickTime
RealPlayer
REALTEK Gigabit and Fast Ethernet NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB925486)
SmartSound Quicktracks Plugin
Sony ACID 4.0f
Sony Ericsson PC Suite 1.20.224
SPBBC
Spybot - Search & Destroy 1.4
SpywareBlaster v3.5.1
Studio 9
Symantec
Symantec Script Blocking Installer
SymNet
Synaptics Pointing Device Driver
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB908531)
Update for Windows XP (KB916595)
WinAce Archiver
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859

Trogan · December 2006

Hi Steve!

I appreciate you may be busy, but please try and reply in a timely manner in order to remove the infections quickly.

Also, the HijackThis log you posted is not new. It is the same as your first post. I need to see a new HijackThis log in your next post please.

You have a nasty infection present. Please follow these instructions carefully.

Download this tool...
http://www.uploads.ejvindh.net/rustbfix.exe
...and save it to your desktop.

Double click on rustbfix.exe to run the tool. If a Rustock.b-infection is found, you will shortly hereafter be asked to reboot the computer. The reboot will probably take quite a while, and perhaps 2 reboots will be needed. But this will happen automatically. After the reboot 2 logfiles will open (%root%\avenger.txt & %root%\rustbfix\pelog.txt). Post the content of these logfiles along with a new HijackThis log.

Run ComboFix again and post its log back here.

Do you know what these are?

C:\FOUND.006
C:\FOUND.005
C:\FOUND.004
C:\FOUND.003
C:\FOUND.002
C:\FOUND.001
C:\FOUND.000

steveobrady · December 2006

************************* Rustock.b-fix -- By ejvindh *************************
08/12/2006 16:16:03.75

******************* Pre-run Status of system *******************

Rootkit driver PE386 is found. Starting the unload-procedure....
Examine the Avenger-logfile in order to assess the success of the unload-procedure

Rustock.b-ADS attached to the System32-folder:
No streams found.

******************* Post-run Status of system *******************

Rustock.b-driver on the system: NONE!

Rustock.b-ADS attached to the System32-folder:
No streams found.

******************************* End of Logfile ********************************

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\jonygjju

*******************

Script file located at: \??\C:\WINDOWS\kcajxhtg.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver PE386 unloaded successfully.
Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.

Completed script processing.

*******************

Finished! Terminate.

Logfile of HijackThis v1.99.1
Scan saved at 16:31:37, on 08/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by113fd.bay113.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.dontstayin.com/misc/ActiveX_4_0_50/ImageUploader4.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

User - 06-12-08 16:32:13.31 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\User\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-11-08 to 2006-12-08 ))))))))))))))))))))))))))))))))))

2006-12-08 16:27 <DIR> d

C:\avenger
2006-12-08 16:23 <DIR> d--hs---- C:\FOUND.022
2006-12-08 16:16 <DIR> d

C:\Rustbfix
2006-12-07 11:41 <DIR> d--hs---- C:\FOUND.021
2006-12-06 14:16 3,968 --a

C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-06 14:16 <DIR> d

C:\Program Files\Grisoft
2006-12-06 14:04 <DIR> d--hs---- C:\FOUND.020
2006-12-02 02:54 <DIR> d--hs---- C:\FOUND.019
2006-12-02 02:38 <DIR> d--hs---- C:\FOUND.018
2006-12-01 22:52 <DIR> d--hs---- C:\FOUND.017
2006-12-01 22:44 <DIR> d--hs---- C:\FOUND.016
2006-12-01 22:26 <DIR> d--hs---- C:\FOUND.015
2006-12-01 22:13 <DIR> d--hs---- C:\FOUND.014
2006-12-01 22:04 <DIR> d--hs---- C:\FOUND.013
2006-12-01 21:56 <DIR> d

C:\Documents and Settings\All Users\Application Data\Avg7
2006-12-01 21:41 <DIR> d--hs---- C:\FOUND.012
2006-12-01 21:33 <DIR> d--hs---- C:\FOUND.011
2006-12-01 13:39 <DIR> d--hs---- C:\FOUND.010
2006-12-01 13:32 <DIR> d--hs---- C:\FOUND.009
2006-12-01 03:37 <DIR> d--hs---- C:\FOUND.008
2006-12-01 03:18 <DIR> d--hs---- C:\FOUND.007
2006-12-01 03:09 <DIR> d--hs---- C:\FOUND.006
2006-11-30 02:46 <DIR> d--hs---- C:\FOUND.005
2006-11-30 01:42 <DIR> d--hs---- C:\FOUND.004
2006-11-30 01:31 <DIR> d--hs---- C:\FOUND.003
2006-11-30 01:03 <DIR> d

C:\Program Files\Hijackthis
2006-11-30 00:45 <DIR> d--hs---- C:\FOUND.002
2006-11-30 00:32 <DIR> d--hs---- C:\FOUND.001
2006-11-30 00:17 <DIR> d

C:\WINDOWS\Internet Logs
2006-11-30 00:07 <DIR> d--hs---- C:\FOUND.000
2006-11-29 21:58 <DIR> d

C:\WINDOWS\system32\Kaspersky Lab
2006-11-29 19:35 <DIR> d

C:\Program Files\SpywareBlaster
2006-11-29 18:35 <DIR> d

C:\Program Files\Spybot - Search & Destroy
2006-11-29 18:35 <DIR> d

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-11-29 18:28 <DIR> d

C:\Documents and Settings\User\Application Data\Lavasoft
2006-11-29 18:27 <DIR> d

C:\Program Files\Lavasoft
2006-11-29 14:41 <DIR> d--h

C:\WINDOWS\$hf_mig$
2006-11-29 14:41 <DIR> d

C:\WINDOWS\system32\PreInstall
2006-11-29 11:25 <DIR> d

C:\WINDOWS\system32\SoftwareDistribution
2006-11-29 00:22 70,724 --a

C:\WINDOWS\system32\lzx32.sys
2006-11-17 01:30 <DIR> d

C:\Documents and Settings\User\Application Data\DivX
2006-11-17 01:18 <DIR> d

C:\Program Files\Mozilla Firefox
2006-11-17 01:18 <DIR> d

C:\Documents and Settings\User\Application Data\Mozilla
2006-11-17 01:17 <DIR> d

C:\Program Files\DivX

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"LaunchApp"="Alaunch"
"High Definition Audio Property Page Shortcut"="HDAShCut.exe"
"AzMixerSel"="C:\\Program Files\\Realtek\\InstallShield\\AzMixerSel.exe"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent"
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"RTHDCPL"="RTHDCPL.EXE"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"EPM-DM"="c:\\acer\\epm\\epm-dm.exe"
"ePowerManagement"="C:\\Acer\\ePM\\ePM.exe boot"
"LManager"="C:\\PROGRA~1\\LAUNCH~1\\QtZgAcer.EXE"
"eRecoveryService"="C:\\Program Files\\Acer\\eRecovery\\Monitor.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"EPSON Stylus Photo R220 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAIE.EXE /P30 \"EPSON Stylus Photo R220 Series\" /O6 \"USB001\" /M \"Stylus Photo R220\""
"PinnacleDriverCheck"="C:\\WINDOWS\\system32\\PSDrvCheck.exe -CheckReg"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
@=""
"Sony Ericsson PC Suite"="\"C:\\Program Files\\Sony Ericsson\\Mobile2\\Application Launcher\\Application Launcher.exe\" /startoptions"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - User.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Completion time: 06-12-08 16:32:53.45
C:\ComboFix2.txt ... 06-12-08 00:52
C:\ComboFix.txt ... 06-12-08 16:32

Trogan · December 2006

Good job!

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 5.0 Update 10.
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement."
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove the following...
- J2SE Runtime Environment 5.0 Update 3
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-1_5_0_10s-windowsi586-p.exe to install the newest version.

________________________________

Your logs are now clean. Please let me know how things are!?

You can delete the following:

ComboFix
C:\ComboFix2.txt
C:\ComboFix.txt
rustbfix.exe
________________________________

Your computer looks to be well protected. Follow these steps to clean out your System Restore points and then check for any Windows Updates.

It's a good idea to Flush your System Restore points after ridding yourself of malware: You can clean this by doing the following:

Click Start | Help and Support | Undo changes to your computer with System Restore.
Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
Close the Help and Support Center box.
Click Start | Run and type Cleanmgr
Select (C: ) then click OK.
Click the More Options tab.
Click Clean Up in the System Restore Section.

This will remove all previous restore points except the newly created one.

Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.

steveobrady · December 2006

Thanks for all the help the computer is running fine again now

Trogan · December 2006

Glad I could be of assistance! The help you received here was free. Please read through some of these Prevention Tips that Short-Media offers.

This topic is now closed. If you wish it reopened, please send a Private Message (PM) to one of the Spyware Mods with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required.

If you are not the user who started this thread, you must start a new Thread instead

Would you also be interested to join Short-Media (Team #93) with the Folding@Home Project? More information available at this link:
http://www.short-media.com/forum/showthread.php?t=29803

[Solved]Help needed!!!

Comments