# {SOLVED}4p1of error



## Zil (Apr 23, 2001)

Do i need to reinstall windows 98 to get rid of a 4p1of error that pops up all the time?

[Edited by Zil on 04-25-2001 at 09:10 AM]


----------



## ~Candy~ (Jan 27, 2001)

Can you explain this a little more? What are you doing when you get this error? Is this the whole error message?


----------



## Zil (Apr 23, 2001)

Its called 4p1of.exe its in windows. 
When the error pops up it says: "This program has performed an illegal operation and will be shut down. 
If the problem persists, contact the vendor." 
In system tools in system information i see it in software environment i see it listed in running tasks.


----------



## ~Candy~ (Jan 27, 2001)

I have no idea what program that is trying to execute, but what I would do is this:

Start button, run, then type msconfig and hit ok, then go to the start up tab, find it there and uncheck it, click ok, and let the computer restart.

Also look at Start button, programs, start up tab and make sure it's not loading from there.


----------



## Rollin' Rog (Dec 9, 2000)

If that spelling is correct, it does not sound like a legitamate program -- quite possibly it is one of the "randomly" named trojans. Do you have an up-to-date antivirus program?

http://antivirus.cai.com/

You should also download Rmbox's Rxpack. If this is a trojan, and depending on how InnoculateIT handles it, you may need to run the exefix08 file to restore certain registry entries.

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

Also running and posting the startup log can help us determine where this is loading from and whether there are any other questionable files which the antivirus may miss.


----------



## Zil (Apr 23, 2001)

The following is a list of your current Start-Ups 
__________________________________________________________________________ 
__________________________________________________________________________

1. HKLM Run - Registry

(Registry Path) 
(Start-Ups)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"TaskMonitor"="c:\\windows\\taskmon.exe"
"Disknag"="C:\\DELL\\DISKNAG.EXE"
"TCASUTIEXE"="TCAUDIAG.EXE -off"
"POINTER"="C:\\PROGRA~1\\MSHARD~1\\point32.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
"TimeSink Ad Client"="\"C:\\Program Files\\TimeSink\\AdGateway\\TSADBOT.EXE\""
"LoadQM"="loadqm.exe"
"3dfx Tools"="rundll32.exe 3dfxCmn.dll,UpdateRegSettings"
"Tray Temperature"="C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHERBUG.EXE 1"
"SystemTray"="SysTray.Exe"

========================================================================== 
__________________________________________________________________________

2. HKCU Run - Registry

(Registry Path) 
(Start-Ups)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Taskbar Display Controls"="RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY"
"MSMSGS"="C:\\Program Files\\Messenger\\msmsgs.exe /background"

========================================================================== 
__________________________________________________________________________

3. HKLM RunOnce - Registry

(Registry Path) 
(Start-Ups)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

4. HKCU RunOnce - Registry

(Registry Path) 
(Start-Ups)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

5. HKLM RunServices - Registry

(Registry Path) 
(Start-Ups)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"AutoShutdown"="C:\\WINDOWS\\pssvc.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"

========================================================================== 
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

(Registry Path) 
(Start-Ups)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

========================================================================== 
__________________________________________________________________________

7. WIN.INI File - C:\WINDOWS

Your win.ini run/load lines should look like run= and load= exclusively. 
There should be nothing to the right of the equal signs.

These are the run and load lines in your WIN.INI file

norun=hpfsched

load=

========================================================================== 
__________________________________________________________________________

8. SYSTEM.INI File - C:\WINDOWS

Your system.ini shell line should look like shell=Explorer.exe exclusively. 
You should only see Explorer.exe following the equal sign.

This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

========================================================================== 
__________________________________________________________________________

9. AUTOEXEC.BAT File - C:\ (Root)

(Some trojans have been known to start from this file)

These are your program startups and set paths in your autoexec.bat file

@SET CLASSPATH=C:\PROGRA~1\PHOTOD~1.1\ADOBEC~1;C:\Program Files\PhotoDeluxe 2.0\AdobeConnectables
SET SNDSCAPE=C:\WINDOWS
REM C:\WINDOWS\COMMAND\MSCDEX /D:MSCD001
SET WIN32DMIPATH=C:\DMI\
SET PATH=C:\DMI\BIN
SET PATH=%PATH%;C:\viavoice\Bin

========================================================================== 
__________________________________________________________________________

10. StartUp Folder - C:\WINDOWS\Start Menu\Programs\StartUp

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Works Calendar Reminders.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\GetRight Tray Icon.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\SwTray.lnk

========================================================================== 
__________________________________________________________________________

11. All Users - C:\WINDOWS\All Users\Start Menu\Programs\StartUp

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your All Users StartUp folder

*(No start-ups found)*

========================================================================== 
__________________________________________________________________________

- End -


----------



## ~Candy~ (Jan 27, 2001)

You said you also see it in the system info, software, can you post the whole reference to it?


----------



## Rollin' Rog (Dec 9, 2000)

No obvious infections there, othre than a piece of "spyware":

http://cexx.org/tsadbot.htm

Which you can get rid of with lavasoft's Ad-Aware program which I highly recommend:

http://www.lavasoft.de/

Don't see anything calling the file which is giving you the error, but there is a lot there which I'm not intimately familiar with.

What I would do is locate the file (you can do a Find Files search for it), then right click and select properties>version. There _should_ be something there to tell you what it is associated with. This may help you identify what you need to disable or reinstall.

You could also try renaming the extension to .old. That way an error message might be generated when the file is called which will tell you more about when it is loading.

Another usually very effective troubleshooting technique is to run msconfig and use the startup tab to clear the checks by non-windows applications. Windows apps include scanregistry, systray, loadpowerprofiles and taskmon.

Stimon is still image monitor used by scanners; I don't think this is the source of the problem but you could temporarily disable it. Many people create a shortcut for it to launch as needed from the desktop when they want to use a scanner, rather than have it always running.

Tray Temperature...weatherbug.exe would be my prime suspect.


----------



## Zil (Apr 23, 2001)

Thank you!! The virus software you gave me found a virus and cleaned it out. 4p1of was part of the virus. Its gone now


----------



## Rollin' Rog (Dec 9, 2000)

Great! but I sure would like to know what it found, since there was nothing that stuck out in your startup profile.


----------



## Zil (Apr 23, 2001)

The virus software said it was Win32.Weird.11264 virus.
It deleted the 4p1of and cleaned out my system.
Strange huh


----------



## ~Candy~ (Jan 27, 2001)

Me too!

OOPPS, your post beat my response....

[Edited by AcaCandy on 04-25-2001 at 02:47 PM]


----------



## Rollin' Rog (Dec 9, 2000)

Not a common virus (actually a type of trojan). Curiously InnoculateIT's library had nothing on it, but symantec's did:

http://www.symantec.com/avcenter/cgi-bin/virauto.cgi?vid=9786

Since this virus/trojan infects explorer.exe, did InnoculateIT report repairing this file? You might want to check your version number of Explorer.exe for the correct file size, using the MS DLL database:

http://support.microsoft.com/servicedesks/fileversion/dllinfo.asp?fr=0&sd=msdn

Could you post the log that InnoculateIT created if you still have it?

[Edited by Rollin' Rog on 04-25-2001 at 03:20 PM]


----------



## Zil (Apr 23, 2001)

noculateIT Personal Edition Version 5.2.9.0
Started scanning:	11:37:35 AM, 4/25/01
Major dat file v1000
Minor dat file v1144
Macro dat file	Feb 20 2001 (VMD Ver 1.6)

Scanning memory...

Scanning boot sectors...
c:\ Master Boot Record matches template, is unknown but seems OK.
c:\ Partition Boot Record matches template, is OK: standard MSWIN 4.1 FAT32.
d:\ Master Boot Record matches template, is OK: standard Clean (48).
d:\ Partition Boot Record matches template, is OK: standard MSWIN 4.1 FAT32.

Scanning file(s)...
c:\WINDOWS\COMMAND\SULFNBK.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\CHLINST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\REGEDIT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\OEMRNCE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\SUCATREG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\OLS\AOL\AOL40AU.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\OLS\AOL\AOL40CA.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\OLS\AOL\AOL40UK.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\OLS\AOL\AOL40US.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\OLS\CSI\CS3KIT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\OLS\CSI\UKKIT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\OLS\CSI\USKIT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\PWS\PRELOAD.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\PWS\REGSVR32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\PWS\SYSOCMGR.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\TOUR\DISCOVER.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\TOUR\WHATSNEW\WHATSNEW.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\239887UP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\DRIVERS\PREINSTL.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\DRIVERS\DAINST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\DRIVERS\_ISDEL.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\DRIVERS\I81XGHLP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\DRIVERS\STARTHTM.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\DRIVERS\DEVNDFIX.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\DRIVERS\SBSETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\AZTEC\INFUNIST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\OPTIONS\CABS\HYPERTRM.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CFGWIZ32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\OOBE\MSOOBE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\LOADWC.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\MSHTA.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\PSTORES.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\MNMSRVC.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CSUNINST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\ACTMOVIE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\ADDREG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CLICONFG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CMDL32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CMMGR32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CMMON32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CMSTP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\DLLHOST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\IE4UINIT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\IESHWIZ.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\INTERNAT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\LIGHTS.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\ODBCAD32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\ODBCCONF.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\REGSVR32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CKCNV.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\SUCATREG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\MACROMED\Shockwave\swinit.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\MACROMED\Shockwave\RemoteSave.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\MACROMED\Shockwave 8\swinit.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\USERSTUB.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\ACCWIZ.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\MAGNIFY.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\MKCOMPAT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\MSCONFIG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\REGWIZ.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\RNAAPP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\RUNONCE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\SFC.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\SPOOL32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\STIMON.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\SYSTRAY.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\TAPI16.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\TAPISRV.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\TCMSETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\TLOCMGR.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WALIGN.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WMIEXE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\VIEWERS\QUIKVIEW.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\AWFXEX32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\BPCPOST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WLTMIME.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WLTUNINS.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WBEM\UNSECAPP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WBEM\WBEMCNTL.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WBEM\WBEMPERM.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WBEM\WBEMSTOP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WBEM\WBEMTEST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\I81XGHLP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\INFUNIST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\TCAUDIAG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\UN3C90XA.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\UNTCATDI.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\DAINST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\LOCPROXY.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\LOCPRXY2.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\NWLSPROC.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\mswheel.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CJPFINS.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CJSTMON.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\CJSTSR.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\ibmwave.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\hpsjrreg.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\htmdeng.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\unam4ie.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\mstinit.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\mobsync.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\logagent.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\icwscrpt.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\MSIPCSV.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\purgedxm.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\VetMsg9x.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\DirectX\Migrate\DPVHELP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\DDHELP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\DXDIAG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\DPLAYSVR.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\DPNSVR.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSTEM\DPVSETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\INF\UNREGPN.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\INF\unregmp2.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\HWINFO.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSBCKUP\MPLAYER.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSBCKUP\DDHELP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSBCKUP\DPLAYSVR.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\MPLAYER.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\CLSPACK.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\FONTVIEW.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\EXTRAC32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\HH.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\HH.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\MSNMGSR1.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\PIDSET.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SIGVERIF.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TUNEUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\UPWIZUN.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\WINREP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\GRPCONV.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\ASD.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\ACCSTAT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\CALC.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\CLEANMGR.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\CVT1.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\CVTAPLOG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\REGEDIT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\MM2ENT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\NOTEPAD.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\PACKAGER.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\PBRUSH.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\RG2CATDB.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\RUNDLL32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SCANREGW.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SNDREC32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SNDVOL32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TASKMAN.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TASKMON.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\VCMUI.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\WELCOME.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\WINHLP32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\WRITE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\CDPLAYER.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\KODAKIMG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\KODAKPRV.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\MSNCREAT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\NETWATCH.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\RSRCMTR.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\SYSMON.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TOUR98.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TWUNK_32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\DRWATSON.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\QFECHECK.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\teaser.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\munC2D5.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\DX70ENG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\RegClean.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\oadist.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\mun4080.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\InstallTool.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\SmartInstall\odigoie55.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\SmartInstall\win_0_english_odigo25b_476.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\instslot.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\sPDPatch.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\instskin.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\Setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\AolOnDesktop.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\insth.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\instlite.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\ATTKIT\setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\driver9x\install.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\driver9x\Setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\instmsia.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\isetup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\pft3B1~TMP\_ISDel.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\pft1280~TMP\VetSetup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TEMP\pft1280~TMP\_ISDel.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\TELNET.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\WINIPCFG.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Desktop\QuickTimeInstaller.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Application Data\Microsoft\WELCOME\WELDATA.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\0EN553I2\%Thunderized%.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\0EN553I2\WinDChiLL\Conseal\license.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\0EN553I2\WinDChiLL\Programs\PORT****.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\0EN553I2\WinDChiLL\Programs\CLICK.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\0EN553I2\WinDChiLL\Programs\IRCKILL.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\0EN553I2\WinDChiLL\Programs\ASSAULT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\0EN553I2\WinDChiLL\Programs\TRACER.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\7318PFY4\dinksmallwood106[1].exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\7318PFY4\PartyLights[1].exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\604R38VJ\angel[1].zip>Tools/nuke.exe - Win32.Nuker.F trojan. 
c:\WINDOWS\Temporary Internet Files\Content.IE5\604R38VJ\angel[1].zip contains infected files.
c:\WINDOWS\Temporary Internet Files\Content.IE5\604R38VJ\xXBoTXx[1]\xXBoTXx.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\A47ZYQYO\msnsetup_min[1].exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Temporary Internet Files\Content.IE5\WPM34HMF\18001900[1].EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\CJRSTR\bjdelete.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\LOADQM.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\ST5UNST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\IsUninst.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\hpfsched.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Mgxclean.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\WallADay.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\MSAGENT\AGENTSVR.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Profiles\Amy\Application Data\Microsoft\WELCOME\WELDATA.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Profiles\Tony\Application Data\Microsoft\WELCOME\WELDATA.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\VIEWS32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\aolback.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\CAMUINST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\speech\VCMD.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Fsuninst.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\4p1of.exe - Win32.Weird.11264 dropper. Deleted.
c:\WINDOWS\EXPLORER.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\wscript.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\WJVIEW.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Jtray.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\uninst.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\NPSExec.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\Lenny Holiday Bash.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\pysoft_uninstaller.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\UNISTB32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\WNBackup\WNS50\wnun50.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\unwise.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\downloads\driver9x\install.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\downloads\driver9x\Setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\downloads\instmsia.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\downloads\isetup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\WINDOWS\downloads\setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\DELL\DOCS\EDOCS.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\DELL\WDELTREE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\DELL\DLYSTART.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\RECYCLED\DC5\The Sims\Downloads\SimsFileCop.exe - infected with Win32.Weird.11264 virus. Restored.
c:\KiddoNet\ConnectionTimeSaving.exe - infected with Win32.Weird.11264 virus. Restored.
c:\KiddoNet\FavOrg.exe - infected with Win32.Weird.11264 virus. Restored.
c:\KiddoNet\KidTheme.exe - infected with Win32.Weird.11264 virus. Restored.
c:\KiddoNet\Kiddonet.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Acrobat3\Reader\AcroRd32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Printfac\pf_del95.exe - infected with Win32.Weird.11264 virus. Restored.
c:\My Documents\Messenger Service Received Files\GB-emulator.exe - infected with Win32.Weird.11264 virus. Restored.
c:\SBPCI\DEVNDFIX.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\SBPCI\SBSETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Microsoft Shared\MSINFO\MSINFO32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Microsoft Shared\equation\EQNEDT32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Microsoft Shared\msdraw\MSDRAW.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Microsoft Shared\wordart\WRDART32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Microsoft Shared\artgalry\ARTGALRY.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Real\Update\nddeserv.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Real\Update\rnuninst.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Real\Update\upgrdhlp.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Netscape Shared\Security\psm.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Netscape Shared\Security\ren8dot3.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\Netscape Shared\Security\ren8dot3.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Common Files\InstallShield\engine\6\Intel 32\IKERNEL.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\CHAT\CCHAT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Plus!\SYSAGENT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Plus!\THEMES.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Plus!\Themes\Frosty v2.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Plus!\Themes\Frosty the Snowman\logos\Frosty Logos.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Plus!\Themes\Frosty the Snowman\webs\wvinstall.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Plus!\Themes\Act of Marraige\logos\Act of Marraige Logos.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Plus!\Themes\Act of Marraige\webs\wvinstall.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Web Publish\WPWIZ.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MS Hardware\Mouse\mousinfo.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MS Hardware\Mouse\uninstal.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MS Hardware\Mouse\mousex32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MS Hardware\TIPS\MOUSE\tips.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MS Hardware\point32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MSWorks\Setup45\SETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MSWorks\Calendar\MSWKSCAL.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MSWorks\Calendar\SETUP\SETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MSWorks\Calendar\WKCALREM.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MSWorks\MSWORKS.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MSWorks\setup\SETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\MSWorks\WORDVIEW.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Accessories\BACKUP\MSBACKUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Accessories\MSPAINT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Accessories\WORDPAD.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Accessories\HyperTerminal\HYPERTRM.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\IEXPLORE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\SIGNUP\CHLINST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\Connection Wizard\ICWOOBE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\Connection Wizard\isignup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\Connection Wizard\icwtutor.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet Explorer\ie5setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Xara\Xara3D4\X3D.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Xara\Xara3D4\X3DHelp.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Online Services\AOL\AOLSETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Online Services\CompuServe\CSSETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Works 4.5\Setup\launcher.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\ImageStrip\ImageView.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\ImageStrip\ImageStrip.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\Home\LnchCC4.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\FtpDl.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\HelpWiz.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\GraphicsBrowser.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\CCUninst.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\CreataCard Special Edition\Register\Itp32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\CreataCard Special Edition\Help\mvplay32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\CreataCard Special Edition\CACard32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\CreataCard Special Edition\VPMaint.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\colorsto\Win95exe\REGSVR32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\colorsto\Win95exe\ColorSto.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\snapshot\Data\Pipeline\Itp32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\snapshot\MGXSS.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Canon Creative\snapshot\SnapShot.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Real\RealPlayer\realplay.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Real\RealPlayer\Setup\setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Real\RealJukebox\Update\rnuninst.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\WakeUp\Wakeup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\HP DeskJet 610C Series\ereg\IQPlayer.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\HP DeskJet 610C Series\ereg\Remind32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\PhotoDeluxe 2.0\PD.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\PhotoDeluxe 2.0\EZPhoto\Ezphoto.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\GetRight\getright.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\GetRight\dinksmallwood106.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\GetRight\regclean.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\GetRight\unwise.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\GetRight\setup-at.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\HP DeskJet 690C Series\hpfiui.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\HP DeskJet 690C Series\hpfxicm.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\HP DeskJet 690C Series\hpfinsta.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet\explorer\Setup\SETUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet\explorer\Setup\IEBATCH.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet\explorer\W2K\expinst.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Internet\explorer\ie5setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\The Learning Company\Big Action Construction\TLCRUN.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\The Learning Company\Big Action Construction\W95start.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\The Learning Company\Big Action Construction\UNINSTAL.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\The Learning Company\Time to Play Pet Shop\TLCRUN.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\The Learning Company\Time to Play Pet Shop\PET95.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\The Learning Company\Time to Play Pet Shop\Uninstal.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\The Learning Company\Little People Christmas Activity Center\TLCRUN.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\The Learning Company\Little People Christmas Activity Center\XFUN32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\The Learning Company\Little People Christmas Activity Center\Uninstal.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Disney Interactive\Magic Artist Studio\DMA.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Nickelodeon\Nick Click (TM)\ereg\Engine.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Nickelodeon\Nick Click (TM)\ereg\Itp32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Nickelodeon\Nick Click (TM)\ereg\Remind32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Adaptec\Shared\ECDC Engine\wmburn.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan LT\hpipcopy.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan LT\hpprsx.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan LT\hpprsclt.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan LT\RunIdeas.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Hewlett-Packard\HP PrecisionScan\ISTech\OCR\caerereg.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Hewlett-Packard\HP PrecisionScan\ISTech\OCR\ocr32le.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Hewlett-Packard\HP PrecisionScan\ISTech\OCR\apicdk.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\PhotoDeluxe HE 3.1\ColorApp.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\PhotoDeluxe HE 3.1\PD3.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\PhotoDeluxe HE 3.1\PhotoParade Player\PhotoParade.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\PhotoDeluxe HE 3.1\EZPhoto\Ezphoto.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\PhotoDeluxe HE 3.1\Register\AdobeReg32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Adobe Type Manager\ATMFM.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Professor Franklin\Photon.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Professor Franklin\UNINSTAL.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Comet\MCC_Install.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\TimeSink\AdGateway\TSADBOT.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\CAM UnZip\cuz.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\CAM UnZip\TSUinst.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Broderbund\The Print Shop Photo Pro\PhotoPro.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Broderbund\The Print Shop Photo Pro\System\RegisterDll.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Broderbund\The Print Shop Photo Pro\EREG\ereg32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Broderbund\The Print Shop Photo Pro\MSRUN32.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Sierra On-line\SIGSPat.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\NetMeeting\CONF.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Macromedia\Fireworks 3\Fireworks 3.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\QuickTime\QuickTimeUpdater.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\QuickTime\QuickTimePlayer.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\QuickTime\QuickTimePlayer.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Resounding\Roger Wilco\UNWISE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Resounding\Roger Wilco\roger.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Black Isle\Baldur's Gate\Config.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Black Isle\Baldur's Gate\Baldur.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Black Isle\Baldur's Gate\BGMain.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Black Isle\Baldur's Gate\Register\Reg32a.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Black Isle\Baldur's Gate\GameSpy\GSpyLite.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Hardware\Game Controllers\Activator.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Hardware\Game Controllers\PROFILER.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Hardware\Game Controllers\GDP2FILE.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Hardware\Game Controllers\SWTRAY.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Hardware\Game Controllers\SWHUB.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Hardware\Game Controllers\UNINSTAL.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Hardware\Game Controllers\Introduction\OUTHTM.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Hardware\Game Controllers\Profiles\Profiles.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Microsoft Hardware\Game Controllers\Profiles\Profile2.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Windows Media Player\wmplayer.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Windows Media Player\dlimport.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Windows Media Player\setup_wm.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Windows Media Player\logagent.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Electronic Arts\Network Play System\NPSPatch.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\CNET\CatchUp\Program\Catch-Up.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Mjuice Media Player\MJUninst.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Mjuice Media Player\MJSecurity.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Mjuice Media Player\MJAgent.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\InstallShield Installation Information\{E0B60E60-DE6D-11D3-83DC-005004B27360}\Setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\InstallShield Installation Information\{2727FBEF-3155-11D4-8F73-0050DA0F6297}\Setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\InstallShield Installation Information\{6231FDA0-7E6F-11D4-A671-006008D09831}\Setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\Messenger\msmsgs.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\AT&T\WNS\Programs\connect.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\AT&T\WNS\Programs\Setup2.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\AT&T\WNS\Programs\wniecfg.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\AT&T\WNS\Programs\Fixit.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\AT&T\WNS\Programs\strthelp.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\AT&T\WNS\Programs\WnUpdate.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\AT&T\WNS\Programs\TrblHelp.exe - infected with Win32.Weird.11264 virus.  Restored.
c:\Program Files\3DO\Might and Magic VII\MM7Setup.Exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\3DO\Might and Magic VII\MM7.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\3DO\Support\Support.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\3DO\Support\SysInfo.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\3DO\GAMEUP.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Program Files\3DO\Might and Magic VI\mm6.exe - infected with Win32.Weird.11264 virus. Restored.
c:\KA\PHONICS\KAMENU.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\KA\PHONICS\LAUNCH.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\KA\PHONICS\PHONICS.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\smart.exe - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\snwave.exe - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\vunus.exe - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\engine.exe - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\enroll.exe - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\audmig.exe - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\miguser.exe - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\sapimon.exe - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\userwiz.exe - infected with Win32.Weird.11264 virus. Restored.
c:\viavoice\bin\vtperdic.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\mirc58t.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\wmp7.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\install.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\xara3d4n.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\fireworks3.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\rp7u-standard-setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\getrt42c.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\wxbugsetupx261b.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\winamp265.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\npxarac.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\npxarac.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\advision_install.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\amwtersc\watrfall27.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\mirc1\LavenderRose\mrclink.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\32_mirc561t.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\kpw22\kpw.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\gameboy\gbc.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\dcom98.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\hhupd.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\msjavx86.exe - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\265334USA8.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\downloads\windowspatch.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\mirc\mirc32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\mirc\mlink32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\mirc\backup\mlink32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Dynamix\TRIBES\InfiniteSpawn.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Dynamix\TRIBES\Tribes.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Dynamix\TRIBES\unTribes.exe - infected with Win32.Weird.11264 virus. Restored.
c:\www\webserver.exe - infected with Win32.Weird.11264 virus. Restored.
c:\download\flash32.exe - infected with Win32.Weird.11264 virus. Restored.
c:\download\shockwaveinstaller.exe - infected with Win32.Weird.11264 virus. Restored.
c:\download\dragonstorm\Dragonstorm Logos.exe - infected with Win32.Weird.11264 virus. Restored.
c:\download\dragonstorm\Dragonstorm.exe - infected with Win32.Weird.11264 virus. Restored.
c:\download\Happy_Halloween\Happy Halloween\Happy Halloween by KiVi Logos.exe - infected with Win32.Weird.11264 virus. Restored.
c:\download\actofmarraige.exe - infected with Win32.Weird.11264 virus. Restored.
c:\download\v3-w9x-1.07.00.exe - infected with Win32.Weird.11264 virus. Restored.
c:\download\DX80eng.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Windows Update Setup Files\IE501DOM.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Windows Update Setup Files\OAINST.EXE - infected with Win32.Weird.11264 virus. Restored.
c:\Windows Update Setup Files\ie5setup.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Windows Update Setup Files\249863usa8_128.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Windows Update Setup Files\249973usa8.exe - infected with Win32.Weird.11264 virus. Restored.
c:\Windows Update Setup Files\256015usa8.exe - infected with Win32.Weird.11264 virus. Restored.
c:\HearMe Setup\HearMeInstaller.exe - infected with Win32.Weird.11264 virus. Restored.
d:\XWingAlliance\Alliance.EXE - infected with Win32.Weird.11264 virus. Restored.
d:\XWingAlliance\XWINGALLIANCE.EXE - infected with Win32.Weird.11264 virus. Restored.
d:\XWingAlliance\register.exe - infected with Win32.Weird.11264 virus. Restored.
d:\XWingAlliance\Website.exe - infected with Win32.Weird.11264 virus. Restored.
d:\XWingAlliance\SysCheck.exe - infected with Win32.Weird.11264 virus. Restored.
d:\XWingAlliance\DXDIAG.EXE - infected with Win32.Weird.11264 virus. Restored.
d:\rainbow\mplaynow.exe - infected with Win32.Weird.11264 virus. Restored.
d:\rainbow\RainbowSix.exe - infected with Win32.Weird.11264 virus. Restored.
d:\vampire\register.exe - infected with Win32.Weird.11264 virus. Restored.
d:\vampire\Ws2setup.Exe - infected with Win32.Weird.11264 virus. Restored.
d:\vampire\Vampire.exe - infected with Win32.Weird.11264 virus. Restored.
d:\vampire\Extras\cs\sysinfo.exe - infected with Win32.Weird.11264 virus. Restored.
d:\thesims\Downloads\BirthdayCake.exe - infected with Win32.Weird.11264 virus. Restored.
d:\RECYCLED\DD68.EXE - infected with Win32.Weird.11264 virus. Restored.
d:\RECYCLED\DD70.EXE - infected with Win32.Weird.11264 virus. Restored.
d:\RECYCLED\DD102\GameData\_SierraUpdatePatch\SierraUpUpdate1201.exe - infected with Win32.Weird.11264 virus. Restored.
d:\RECYCLED\DD102\GameData\patch\22047-22075.exe - infected with Win32.Weird.11264 virus. Restored.
d:\RECYCLED\DD102\21570-22047.exe - infected with Win32.Weird.11264 virus. Restored.
d:\gunship\GSReg.exe - infected with Win32.Weird.11264 virus. Restored.
d:\gunship\gunship.exe - infected with Win32.Weird.11264 virus. Restored.
d:\sacrifice\Sacrifice.exe - infected with Win32.Weird.11264 virus. Restored.
d:\sacrifice\scapex.exe - infected with Win32.Weird.11264 virus. Restored.

Finished scanning:	1:00:00 PM, 4/25/01
Number of files scanned: 80388.
Number of archives containing infected files: 1
Number of infections: 504
Number of infections cleaned: 502
Number of infected files deleted: 1
Number of infected files not cleaned/deleted/renamed: 1
c:\WINDOWS\Temporary Internet Files\Content.IE5\604R38VJ\angel[1].zip>Tools/nuke.exe (Win32.Nuker.F trojan)

Restart Windows to complete cleaning.

[Edited by Zil on 04-25-2001 at 05:45 PM]


----------



## Rollin' Rog (Dec 9, 2000)

WOW  InnoculateIT sure worked overtime on that one. Must have been crap flyin' out of the fan vents .

Looks like weird had it's hooks into most of the .exe's in your system.


----------



## Zil (Apr 23, 2001)

Now i know why my computer was acting insane. Thank you so much for helping me through this.


----------



## Rollin' Rog (Dec 9, 2000)

You're welcome, thanks for the follow-up, I didn't expect it to be so humongous, but it looks like InnoculateIT did a thorough job.

Since this was a "backdoor" trojan, it would probably be a good idea to change any passwords for critical sites. You may well have been monitored.


----------



## Zil (Apr 23, 2001)

ok thanks


----------

