Explorer Exe Constantly crashing/restarting (HJT log Review please)

Unknown

First off I'd like to say that I'm running Windows Vista Premium.

Recently I was prompted to download a Video Active X (I assume it was a smitfraud) and after it was installed I rebooted the computer and explorer exe kept crashing and restarting. There was also a new security program that apparently was downloaded too (I forgot the name, sorry). I deleted the Video Active X folder I found in my program files as well as uninstalling the security program. The crashing and restarting of Explorer.exe continued though. I ran CCleaner many times to see if it could find any issues and get rid of them. It found some and deleted them but the crashing continued. I tried following the Smitfraud removal sticky but some of the programs didn't work since I'm running vista. I've also tried vundofix to see if that might've been the problem but that didn't work either.


Here's the HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:43:03 PM, on 7/23/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Steam\Steam.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iTunes\iTunes.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Andres\Desktop\procexp.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {D61D7E1A-6613-49CA-B6F9-51DB248E209D} - C:\Program Files\Video ActiveX Access\iesplg.dll
O3 - Toolbar: Protection Bar - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - C:\Program Files\Video ActiveX Access\iesbpl.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Trogan

Hi Dethshoot1, and apologies for the delay.

You don't appear to be using an Anti-Virus or Firewall program. Is there a reason for this? Let me know. I can provide a list of Free programs, if you'd like.

1. Please download Rogue Remover.
2. Unzip the file to your Desktop or to a convenient location.
3. Run the Installer.
4. In the lower right corner, click Check For Updates.
5. After Updates are completed, start the program and select Scan.
6. Follow the prompts which will take you through the remaining steps.
7. When finished, Rogue Remover will display the results.

Please post the RogueRemover results, along with a new HijackThis log.

Dethshoot1

I checked the Windows Firewall and Anti-Virus program and it was on. Could it be that it wasn't detected because I'm running Vista?

RogueRemover:
Malwarebytes' RogueRemover
Malwarebytes ©2007 http://www.malwarebytes.org
5468 total fingerprints loaded.

Loading database ...
Expanding environmental variables ...

Scanning files ... [ 100% ].
Scanning folders ... [ 100% ].
Scanning registry keys ... [ 100% ].
Scanning registry values ... [ 100% ].

RogueRemover has detected rogue antispyware components! Results below...

Type: Registry Value
Vendor: Video ActiveX Access
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar|{29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00}
Selected for removal: Yes

RogueRemover has found the objects above.

HJTLog:
Logfile of HijackThis v1.99.1
Scan saved at 11:43:03 PM, on 7/23/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Steam\Steam.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iTunes\iTunes.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Andres\Desktop\procexp.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {D61D7E1A-6613-49CA-B6F9-51DB248E209D} - C:\Program Files\Video ActiveX Access\iesplg.dll
O3 - Toolbar: Protection Bar - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - C:\Program Files\Video ActiveX Access\iesbpl.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Trogan

Hi,

I checked the Windows Firewall and Anti-Virus program and it was on. Could it be that it wasn't detected because I'm running Vista?

Yes, and the fact that HijackThis 1.99.1 does not recognise Vista properly. I'd like you to uninstall HijackThis 1.99.1, and install this new version of HijackThis - Follow the instructions below.

Download HJTInstall.exe to your Desktop.

• Doubleclick HJTInstall.exe to install it.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Copy/Paste the log to your next reply please.
• Don't use the Analyse This button, its findings are dangerous if misinterpreted.
• Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Does Vista have a built-in Anti-Virus program? I have no experience with Vista as of yet so I don't know.

Dethshoot1

I checked the Security center, Vista does not have an anti-virus program.

HJTLog:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:52 AM, on 7/27/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [McLogLch_exe] C:\Program Files\McAfee\MSC\McLogLch.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O22 - SharedTaskScheduler: enlodgement - {aa6d4f53-4c8d-4549-84d2-02d584acc4e9} - C:\Windows\system32\wzhtjqo.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe (file missing)
O23 - Service: McAfee Update Manager (mcmispupdmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe (file missing)
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe (file missing)
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mctskshd.exe (file missing)
O23 - Service: McAfee User Manager (mcusrmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe (file missing)

--
End of file - 5183 bytes

Trogan

Hi,

I see you have McAfee, so that's fine.

Please do the following...

1. Open HijackThis
- Click the Do a system scan only button
- Check the following entries (below)

O22 - SharedTaskScheduler: enlodgement - {aa6d4f53-4c8d-4549-84d2-02d584acc4e9} - C:\Windows\system32\wzhtjqo.dll

- Close ALL open windows (especially Internet Explorer!)
- Click Fix Checked
Close HiajckThis

2. Run HijackThis again and click on Open the Misc Tools section.
Click on Delete a file on reboot...
Copy and paste the following into the "File name:" text box and then click Open:

C:\Windows\system32\wzhtjqo.dll

When you are asked "Do you want to restart your computer now?", click OK.

Your PC MUST reboot to delete the file!

3. Please post a new HijackThis log.

Dethshoot1

When I tried to fix 022 I got this Error:


An unexpected error has occured at procedure:
modBackup_MakeBackup(sItem=022 - SharedTaskScheduler:enlodgement - {aa6d4f53-4c8d-4549-84-d2-02d584acc4e9} -
C:\Windows\system32\wzhtjqo.dll)
Error #5 - Invalid procedure call or argument

Trogan

Do number 2 above, and then post a new HijackThis log.

Dethshoot1

HJTLog:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:52 AM, on 7/27/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [McLogLch_exe] C:\Program Files\McAfee\MSC\McLogLch.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O22 - SharedTaskScheduler: enlodgement - {aa6d4f53-4c8d-4549-84d2-02d584acc4e9} - C:\Windows\system32\wzhtjqo.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe (file missing)
O23 - Service: McAfee Update Manager (mcmispupdmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe (file missing)
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe (file missing)
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mctskshd.exe (file missing)
O23 - Service: McAfee User Manager (mcusrmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe (file missing)

--
End of file - 5183 bytes

Trogan

That's not a new HijackThis log. When I ask for a new log, I want you to press Do a system scan and save a logfile in HijackThis to create a new log.

Dethshoot1

Agh, so sorry Trogan. I messed up on the copy/paste.

HJTLog:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:40:55 PM, on 7/27/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Steam\Steam.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Andres\Desktop\procexp\procexp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [McLogLch_exe] C:\Program Files\McAfee\MSC\McLogLch.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O22 - SharedTaskScheduler: enlodgement - {aa6d4f53-4c8d-4549-84d2-02d584acc4e9} - C:\Windows\system32\wzhtjqo.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe (file missing)
O23 - Service: McAfee Update Manager (mcmispupdmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe (file missing)
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe (file missing)
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mctskshd.exe (file missing)
O23 - Service: McAfee User Manager (mcusrmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe (file missing)

--
End of file - 6491 bytes

Trogan

You may wish to Print or Save the following instructions, as the internet will not be available once in Safe Mode!

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

• Install AVG Anti-Spyware by double clicking the installer.
• Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
• On the main screen under Your Computer's security.
  • Click on Change state next to Resident shield. It should now change to inactive.
  • Click on Change state next to Automatic updates. It should now change to inactive.
  • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
  • Wait until you see the Update succesfull message.
• Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

Once in Safe Mode:

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

• Click on Scanner on the toolbar.
• Click on the Settings tab.
  • Under How to act?
    • Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    • All checkboxes should be ticked.
  • Under Possibly unwanted software:
    • All checkboxes should be ticked.
  • Under Reports:
    • Select Do not automatically generate reports
  • Under What to scan?
    • Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished, follow the instructions below.
  IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
    
• When done, click the Save Scan Report button. (4)
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes

. Reboot back into Normal Mode, and post a new HJT log, along with the AVG anti-spyware log.

Dethshoot1

HJTLog:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:04:34 PM, on 7/27/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Steam\Steam.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Windows\system32\WerCon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Andres\Desktop\procexp\procexp.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\explorer.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [McLogLch_exe] C:\Program Files\McAfee\MSC\McLogLch.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O22 - SharedTaskScheduler: enlodgement - {aa6d4f53-4c8d-4549-84d2-02d584acc4e9} - C:\Windows\system32\wzhtjqo.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe (file missing)
O23 - Service: McAfee Update Manager (mcmispupdmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe (file missing)
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe (file missing)
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mctskshd.exe (file missing)
O23 - Service: McAfee User Manager (mcusrmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe (file missing)

--
End of file - 5368 bytes

Dethshoot1

I'll have to split this log into 2 posts.

---

AVG Anti-Spyware - Scan Report

---

+ Created at: 7:58:33 PM 7/27/2007

+ Scan result:



C:\t.rar/Setup.exe -> Backdoor.IRCBot.dd : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc22\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc23\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc24\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc25\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc26\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc27\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc28\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc29\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc30\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc31\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc32\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc33\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc35\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc36\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc37\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc38\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-18\Dc40\Update.exe -> Downloader.Agent : Cleaned with backup (quarantined).
C:\Program Files\Hijackthis\backups\backup-20070723-235809-742.dll -> Downloader.Zlob.bov : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP113\A1970899.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP113\A1971886.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP113\A1972904.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP113\A1972917.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP113\A1972918.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP113\A1973917.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP113\A1973921.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1973931.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1973932.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1973968.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1973972.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1974937.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1974941.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1975937.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1975960.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP115\A1976959.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP116\A1977960.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP116\A1978960.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP117\A1979960.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP118\A1979977.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP118\A1980004.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP118\A1981005.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1981715.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1981736.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1981760.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1981778.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1982779.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1982918.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1983820.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1983837.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1984837.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1985837.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP121\A1986688.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP121\A1987679.sys -> Proxy.Agent.mx : Cleaned with backup (quarantined).
C:\Users\Andres\AppData\Roaming\Microsoft\Windows\Cookies\andres@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.240:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.25:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.26:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.73:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Users\Andres\AppData\Roaming\Microsoft\Windows\Cookies\andres@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.182:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.106:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.72:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.233:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.235:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.236:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.237:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Andres\AppData\Roaming\Microsoft\Windows\Cookies\andres@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.7:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.8:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.
:mozilla.68:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.69:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.70:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.132:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
C:\Users\Andres\AppData\Roaming\Microsoft\Windows\Cookies\andres@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
C:\Users\Andres\AppData\Roaming\Microsoft\Windows\Cookies\andres@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.43:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.123:C:\Users\Andres\AppData\Roaming\Mozilla\Firefox\Profiles\ci0jxneu.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Users\Andres\AppData\Roaming\Microsoft\Windows\Cookies\andres@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1975956.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP115\A1976979.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP116\A1978974.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP117\A1979974.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP118\A1979994.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP120\A1981756.exe -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP114\A1975971.exe -> Trojan.Small.oa : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-585797964-2030905104-3593365595-1008\Dc95\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
C:\Warcraft III\Maps\Download\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP10622\src\setup\instantsharedevices\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\MANIFEST\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\NAV\Parent\SYMSHARE\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\MANIFEST\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\PControl\SYMSHARE\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\MANIFEST\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\Setup\SYMSHARE\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).

Dethshoot1

D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\CCPD-LC\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\MANIFEST\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\SymLT\SYMSHARE\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\MANIFEST\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\Options\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Setup\asCore\SYMSHARE\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\MANIFEST\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\SPBBC\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SPBBC\SPBBC\SYMSHARE\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymMCEAI\SymMCEAI\SYMSHARE\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\IDS\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\3dsmax_9_(3D_Studio_Max)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\ACDSee_9_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\Adobe_Photoshop_10_(CS3)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\Adobe_Premiere_9_(2.0_pro)_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\Ahead_Nero_8_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\DivX_7.0_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\ICQ_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\Internet_Explorer_7_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\Kazaa_4_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\Longhorn_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Manifest\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\Microsoft_Office_2006_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).
D:\I386\APPS\APP14155\src\Support\SymNet\SymNet\SYMSHARE\winamp_5.2_new!_full+crack.zip/webinstall.exe -> Worm.Feebs.ip : Cleaned with backup (quarantined).


::Report end

Trogan

Good job! AVG Anti-Spyware removed a lot.

Lets try this again:

1. Open HijackThis
- Click the Do a system scan only button
- Check the following entries (below)

O22 - SharedTaskScheduler: enlodgement - {aa6d4f53-4c8d-4549-84d2-02d584acc4e9} - C:\Windows\system32\wzhtjqo.dll

- Close ALL open windows (especially Internet Explorer!)
- Click Fix Checked
Close HiajckThis

2. Run HijackThis again and click on Open the Misc Tools section.
Click on Delete a file on reboot...
Copy and paste the following into the "File name:" text box and then click Open:

C:\Windows\system32\wzhtjqo.dll

When you are asked "Do you want to restart your computer now?", click OK.

Your PC MUST reboot to delete the file!

3. Please post a new HijackThis log

Dethshoot1

That problem seems to be fixed now. Explorer.exe is no longer crashing! Thank you so much Trogan! Really appreciate you taking the time to help me get this fixed!

Also here's the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:53:13 PM, on 7/27/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Steam\Steam.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [McLogLch_exe] C:\Program Files\McAfee\MSC\McLogLch.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe (file missing)
O23 - Service: McAfee Update Manager (mcmispupdmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe (file missing)
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe (file missing)
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mctskshd.exe (file missing)
O23 - Service: McAfee User Manager (mcusrmgr) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe (file missing)

--
End of file - 5181 bytes

Trogan

You're welcome! I'm glad the problem is solved!

Just one more thing left to do:

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

• Download the latest version of Java Runtime Environment (JRE) 6u2.
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.

Apart from that, everything looks good.

Let me know if you have any questions or if we can archive this thread.

Trogan

Can we archive this thread?

Dethshoot1

Oh sorry for the slow reply. I thought everything was done. Yes this thread can be archived now.

Trogan

Thanks! Thread archived!