# dwm.exe and taskhost.exe problem



## hendri1995 (Dec 2, 2012)

Hi there, I have a problem here.
There is one notification "dwm.exe" and sometime it change into "taskhost.exe". The information "There is no disk in the drive. Please insert a disk into drive\Device\Harddisk1\DR2" and it has 3 options "cancel", "try again", and "Continue"
When I click one of them the notif is still there and it use almost 50% of cpu usgae

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:25:04 PM, on 12/2/2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\System32\rundll32.exe
C:\Users\Hendri\AppData\Local\Temp\tlric.exe
C:\Users\Hendri\AppData\Local\Temp\winfwoa.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Modem AC2726 UI\bin\App.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{92468551-980F-49B8-896C-A17D08C8F264}: NameServer = 10.17.3.245 10.17.125.229
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: UDisk Monitor - Unknown owner - C:\Program Files\Modem AC2726 UI\bin\MonServiceUDisk.exe

--
End of file - 5064 bytes

DDS (Ver_2012-11-20.01) - NTFS_x86 
Internet Explorer: 8.0.7600.16385
Run by Hendri at 17:27:24 on 2012-12-02
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1014.308 [GMT -8:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files\Modem AC2726 UI\bin\MonServiceUDisk.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\SearchIndexer.exe
C:\Users\Hendri\AppData\Local\Temp\tlric.exe
C:\Users\Hendri\AppData\Local\Temp\winfwoa.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Modem AC2726 UI\bin\App.exe
C:\Windows\system32\WUDFHost.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k secsvcs
.
============== Pseudo HJT Report ===============
.
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office14\GROOVEEX.DLL
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
uRun: [Google Update] "c:\users\hendri\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
TCP: Interfaces\{92468551-980F-49B8-896C-A17D08C8F264} : NameServer = 10.17.3.245 10.17.125.229
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office14\GROOVEEX.DLL
.
============= SERVICES / DRIVERS ===============
.
R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2012-11-22 3290304]
R2 UDisk Monitor;UDisk Monitor;c:\program files\modem ac2726 ui\bin\MonServiceUDisk.exe [2012-12-2 266240]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]
R3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [2012-12-2 104704]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-10-19 230064]
.
=============== Created Last 30 ================
.
2012-12-03 01:04:15	388096	----a-r-	c:\users\hendri\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2012-12-03 01:04:15	--------	d-----w-	c:\program files\Trend Micro
2012-12-02 22:53:35	--------	d-----w-	C:\AetherFlyff - Basilisk
2012-12-02 18:39:13	--------	d-----w-	c:\program files\GUM8822.tmp
2012-12-02 18:27:57	6812136	----a-w-	c:\programdata\microsoft\windows defender\definition updates\{c0c319c0-81a0-42e5-89f4-e523084a41b3}\mpengine.dll
2012-12-02 18:27:55	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-12-02 17:23:04	--------	d-----r-	c:\program files\Skype
2012-12-02 17:20:45	--------	d-----w-	c:\users\hendri\appdata\local\Programs
2012-12-02 17:16:12	99176	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2012-12-02 17:16:12	49472	----a-w-	c:\windows\system32\netfxperf.dll
2012-12-02 17:16:12	297808	----a-w-	c:\windows\system32\mscoree.dll
2012-12-02 17:16:12	295264	----a-w-	c:\windows\system32\PresentationHost.exe
2012-12-02 17:16:11	1130824	----a-w-	c:\windows\system32\dfshim.dll
2012-12-02 17:10:46	--------	d-----w-	c:\users\hendri\appdata\roaming\ZTEMTUI
2012-12-02 17:05:38	--------	d-----w-	c:\program files\Microsoft Synchronization Services
2012-12-02 17:05:09	--------	d-----w-	c:\windows\PCHEALTH
2012-12-02 17:05:09	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition
2012-12-02 17:04:03	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2012-12-02 16:58:19	--------	d-----w-	c:\program files\Microsoft Analysis Services
2012-12-02 16:56:31	--------	d-----w-	c:\users\hendri\appdata\local\Microsoft Help
2012-12-02 16:56:12	--------	d-sh--w-	c:\windows\Installer
2012-12-02 16:50:02	104704	----a-w-	c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys
2012-12-02 16:49:59	--------	d-----w-	c:\program files\Modem AC2726 UI
2012-12-02 16:48:11	175616	----a-w-	c:\windows\system32\unrar.dll
2012-12-02 16:48:10	839680	----a-w-	c:\windows\system32\lameACM.acm
2012-12-02 16:48:09	74752	----a-w-	c:\windows\system32\ff_vfw.dll
2012-12-02 16:48:09	650752	----a-w-	c:\windows\system32\xvidcore.dll
2012-12-02 16:48:09	243200	----a-w-	c:\windows\system32\xvidvfw.dll
2012-12-02 16:48:09	237568	----a-w-	c:\windows\system32\yv12vfw.dll
2012-12-02 16:48:09	151552	----a-w-	c:\windows\system32\ac3acm.acm
2012-12-02 16:48:07	--------	d-----w-	c:\program files\K-Lite Codec Pack
2012-12-02 16:46:21	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-02 16:43:25	--------	d-----w-	c:\users\hendri\appdata\local\Google
2012-12-02 16:39:16	--------	d-----w-	c:\windows\system32\wbem\Performance
2012-12-02 16:19:55	--------	d-----w-	c:\windows\Panther
2012-12-02 16:11:25	--------	d-----w-	C:\Windows.old.000
2012-12-02 06:23:29	99328	--sh--r-	C:\ggwldv.exe
2012-12-02 01:28:45	--------	d-----w-	C:\0b7846108bb474693002544a
2012-12-02 00:54:33	--------	d-sh--w-	C:\[Smad-Cage]
2012-12-01 23:59:48	--------	d-sh--w-	C:\Recovery
2012-12-01 23:40:10	--------	d-----w-	C:\Windows.old
2012-12-01 23:39:36	--------	d-sh--w-	C:\Boot
.
==================== Find3M ====================
.
.
============= FINISH: 17:28:17.30 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Ultimate 
Boot Device: \Device\HarddiskVolume2
Install Date: 12/2/2012 8:36:48 AM
System Uptime: 12/2/2012 4:31:00 PM (1 hours ago)
.
Motherboard: Acer | | Volvi 
Processor: Intel(R) Core(TM) Duo CPU T2450 @ 2.00GHz | U2E1 | 2000/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 51 GiB total, 22.644 GiB free.
D: is FIXED (NTFS) - 51 GiB total, 32.1 GiB free.
E: is CDROM ()
F: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: 
Description: Mass Storage Controller
Device ID: PCI\VEN_1217&DEV_7130&SUBSYS_012F1025&REV_01\4&34FE2E10&0&33F0
Manufacturer: 
Name: Mass Storage Controller
PNP Device ID: PCI\VEN_1217&DEV_7130&SUBSYS_012F1025&REV_01\4&34FE2E10&0&33F0
Service: 
.
==== System Restore Points ===================
.
RP1: 12/2/2012 8:55:56 AM - Installed Microsoft Office Professional Plus 2010
RP2: 12/2/2012 9:15:57 AM - Windows Update
RP3: 12/2/2012 9:57:04 AM - Windows Update
RP4: 12/2/2012 5:03:45 PM - Installed HiJackThis
.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
AetherFlyff - Basilisk version 1.0.0.4
Google Chrome
HiJackThis
K-Lite Codec Pack 7.5.0 (Full)
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Modem AC2726 UI
Skype Click to Call
Skype 6.0
.
==== Event Viewer Messages From Past Week ========
.
12/2/2012 8:50:39 AM, Error: Service Control Manager [7030] - The UDisk Monitor service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
12/2/2012 4:30:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
12/2/2012 4:29:38 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
12/2/2012 4:29:36 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
12/2/2012 4:29:36 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
12/2/2012 4:29:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
12/2/2012 4:29:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
12/2/2012 4:29:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/2/2012 4:29:24 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
12/2/2012 4:29:17 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
12/2/2012 4:29:17 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
.
==== End Of File ===========================


----------



## kevinf80 (Mar 21, 2006)

Have you recently just re-installed windows? OK do the following:

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from the following link :-

*Combofix*


 Ensure that Combofix is saved directly to the Desktop * <--- Very important*

 Disable all security programs as they will have a negative effect on Combofix, instructions available *Here* if required. Be aware the list may not have all programs listed, if you need more help please ask.

 Close any open browsers and any other programs you might have running

 Double click the







icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)

 Instructions for running Combofix available *Here* if required.

 If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.

 When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

*******Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze* ******

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read *Here* why disabling autoruns is recommended.

*EXTRA NOTES*

 If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
 *If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal*
 If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin


----------



## hendri1995 (Dec 2, 2012)

Do I need to post the HijackThis log again?
It still same
Any idea?

ComboFix 12-12-01.02 - Hendri 12/02/2012 18:13:36.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1014.494 [GMT -8:00]
Running from: c:\users\Hendri\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\autorun.inf
C:\ggwldv.exe
c:\windows\ujnqdb.log
D:\Autorun.inf
D:\keavn.pif
.
.
((((((((((((((((((((((((( Files Created from 2012-11-03 to 2012-12-03 )))))))))))))))))))))))))))))))
.
.
2012-12-03 01:04 . 2012-12-03 01:04	--------	d-----w-	c:\program files\Trend Micro
2012-12-02 22:53 . 2012-12-02 23:41	--------	d-----w-	C:\AetherFlyff - Basilisk
2012-12-02 18:39 . 2012-12-02 18:39	--------	d-----w-	c:\program files\GUM8822.tmp
2012-12-02 18:27 . 2012-11-19 09:04	6812136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C0C319C0-81A0-42E5-89F4-E523084A41B3}\mpengine.dll
2012-12-02 18:27 . 2012-05-31 20:25	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-12-02 17:23 . 2012-12-02 17:24	--------	d-----r-	c:\program files\Skype
2012-12-02 17:23 . 2012-12-02 17:23	--------	d-----w-	c:\program files\Common Files\Skype
2012-12-02 17:22 . 2012-12-02 17:56	--------	d-----w-	c:\programdata\Skype
2012-12-02 17:16 . 2009-11-25 19:47	49472	----a-w-	c:\windows\system32\netfxperf.dll
2012-12-02 17:16 . 2009-11-25 19:47	297808	----a-w-	c:\windows\system32\mscoree.dll
2012-12-02 17:16 . 2009-11-25 19:47	99176	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2012-12-02 17:16 . 2009-11-25 19:47	295264	----a-w-	c:\windows\system32\PresentationHost.exe
2012-12-02 17:16 . 2009-11-25 19:47	1130824	----a-w-	c:\windows\system32\dfshim.dll
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft Synchronization Services
2012-12-02 17:05 . 2012-12-02 18:04	--------	d-----w-	c:\program files\Microsoft.NET
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\windows\PCHEALTH
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft Sync Framework
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition
2012-12-02 17:04 . 2012-12-02 17:04	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2012-12-02 16:58 . 2012-12-02 16:58	--------	d-----w-	c:\program files\Microsoft Analysis Services
2012-12-02 16:56 . 2012-12-02 17:09	--------	d-----w-	c:\programdata\Microsoft Help
2012-12-02 16:56 . 2012-12-03 01:04	--------	d-sh--w-	c:\windows\Installer
2012-12-02 16:50 . 2009-07-28 17:41	104704	----a-w-	c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys
2012-12-02 16:49 . 2012-12-02 16:50	--------	d-----w-	c:\program files\Modem AC2726 UI
2012-12-02 16:48 . 2011-03-02 10:43	175616	----a-w-	c:\windows\system32\unrar.dll
2012-12-02 16:48 . 2008-09-24 18:41	839680	----a-w-	c:\windows\system32\lameACM.acm
2012-12-02 16:48 . 2011-07-22 08:00	74752	----a-w-	c:\windows\system32\ff_vfw.dll
2012-12-02 16:48 . 2011-07-16 14:17	151552	----a-w-	c:\windows\system32\ac3acm.acm
2012-12-02 16:48 . 2011-06-24 14:44	243200	----a-w-	c:\windows\system32\xvidvfw.dll
2012-12-02 16:48 . 2011-06-24 14:28	650752	----a-w-	c:\windows\system32\xvidcore.dll
2012-12-02 16:48 . 2010-11-03 18:08	237568	----a-w-	c:\windows\system32\yv12vfw.dll
2012-12-02 16:48 . 2012-12-02 16:48	--------	d-----w-	c:\program files\K-Lite Codec Pack
2012-12-02 16:46 . 2012-12-02 16:46	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-02 16:46 . 2012-12-02 16:46	--------	d-----w-	c:\windows\system32\Macromed
2012-12-02 16:39 . 2012-12-03 00:49	--------	d-----w-	c:\windows\system32\wbem\Performance
2012-12-02 16:36 . 2012-12-02 16:37	--------	d-----w-	c:\users\Hendri
2012-12-02 16:19 . 2012-12-02 16:36	--------	d-----w-	c:\windows\Panther
2012-12-02 01:28 . 2012-12-02 04:41	--------	d-----w-	C:\0b7846108bb474693002544a
2012-12-02 00:54 . 2012-12-02 04:27	--------	d-----w-	C:\[Smad-Cage]
2012-12-02 00:05 . 2012-12-02 04:54	--------	d-----r-	C:\MSOCache
2012-12-01 23:59 . 2012-12-02 16:35	--------	d-----w-	C:\Recovery
2012-12-01 23:40 . 2012-12-01 23:40	--------	d-----w-	C:\Windows.old
2012-12-01 23:39 . 2012-12-02 16:19	--------	d-----w-	C:\Boot
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-03 02:20 . 2012-12-03 02:20	99328	--sh--r-	C:\tmlk.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-10-20 17956016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-01-22 169344]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
S2 UDisk Monitor;UDisk Monitor;c:\program files\Modem AC2726 UI\bin\MonServiceUDisk.exe [x]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
S3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\DRIVERS\CT_ZTEMT_U_USBSER.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1812936006-1292451050-3836158646-1000Core.job
- c:\users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02 18:39]
.
2012-12-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1812936006-1292451050-3836158646-1000UA.job
- c:\users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02 18:39]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: Interfaces\{92468551-980F-49B8-896C-A17D08C8F264}: NameServer = 10.17.3.245 10.17.125.229
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\taskhost.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\conhost.exe
.
**************************************************************************
.
Completion time: 2012-12-02 18:23:09 - machine was rebooted
ComboFix-quarantined-files.txt 2012-12-03 02:23
.
Pre-Run: 24,225,132,544 bytes free
Post-Run: 24,184,188,928 bytes free
.
- - End Of File - - 963CCAE041D7EFD49EA5C9B573CF86BF


----------



## kevinf80 (Mar 21, 2006)

Continue as follows......

1. Download Malwarebytes Anti-Rootkit from this link http://www.malwarebytes.org/products/mbar/
2. Unzip the File to a convenient location. (Recommend the Desktop)
3. Open the folder where the contents were unzipped to run *mbar.exe*










4. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image:










5. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.)

6. The following image opens, select Next.










7. The following image opens, select Update










8. When the Update completes, select Next










9. In the following window ensure "Targets" are ticked. Then select "Scan"










10. If an infection/s is found the *"Cleanup Button"* to remove threats will be available. A list of infected files will be listed like the following example:










11. *Do not* select the "Clean up Button" select the "Exit" button, there will be a warning as follows:










12. Select "Yes" to close down the program. If NO infections were found you will see the following image:










13. Select "Exit" to close down.
14. Copy and paste the two following logs from the *mbar* folder:

*System - log*
*Mbar - log* Date and time of scan will also be shown










Post those two logs in your reply.

Kevin...


----------



## hendri1995 (Dec 2, 2012)

Here is the result

Malwarebytes Anti-Rootkit 1.1.0.1009
www.malwarebytes.org

Database version: v2012.12.02.02

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Hendri :: HENDRI-PC [administrator]

12/2/2012 9:10:04 PM
mbar-log-2012-12-02 (21-10-04).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: PUP | PUM | P2P
Objects scanned: 26934
Time elapsed: 24 minute(s), 23 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 3
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Delete on reboot. [670c76478fce54e24538a9867d878878]
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Delete on reboot. [591a03ba1845dc5a027c62cd4db79769]
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Delete on reboot. [175c7845fe5f6cca92edd15e27ddcd33]

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\tmlk.exe (Trojan.Agent) -> Delete on reboot. [2a499f1e520b1422085883adb94701ff]

(end)

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.000000 GHz
Memory total: 1063444480, free: 305672192

------------ Kernel report ------------
12/02/2012 20:18:10
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\DRIVERS\ACPI.sys
\SystemRoot\system32\DRIVERS\WMILIB.SYS
\SystemRoot\system32\DRIVERS\msisadrv.sys
\SystemRoot\system32\DRIVERS\pci.sys
\SystemRoot\system32\DRIVERS\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\DRIVERS\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\DRIVERS\intelide.sys
\SystemRoot\system32\DRIVERS\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\atapi.sys
\SystemRoot\system32\DRIVERS\ataport.SYS
\SystemRoot\system32\DRIVERS\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\vmstorfl.sys
\SystemRoot\system32\DRIVERS\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\igdkmd32.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\b57nd60x.sys
\SystemRoot\system32\DRIVERS\bcmwl6.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\1394ohci.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\VSTAZL3.SYS
\SystemRoot\system32\DRIVERS\VSTDPV3.SYS
\SystemRoot\system32\DRIVERS\VSTCNXT3.SYS
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\CT_ZTEMT_U_USBSER.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\Wldap32.dll
\Windows\System32\clbcatq.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff85d8eac8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000007a\
Lower Device Object: 0xffffffff85d8dcb8
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
DriverEntry returned 0x0
Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff84f25a90
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xffffffff84ab6908
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
DriverEntry returned 0x0
Function returned 0x0
Downloaded database version: v2012.12.02.02
No address found
Downloaded database version: v2012.12.02.02
Downloaded database version: v2012.11.30.01
Initializing...
Done!
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff84f25a90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff84f25778, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff84f25a90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff84e69918, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff84ab6908, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffff84c313a8, 0xffffffff84f25a90, 0xffffffffb3514340
Lower DeviceData: 0xffffffffa8481490, 0xffffffff84ab6908, 0xffffffff860d6c20
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 47B00E8C

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 20480000

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 20482048 Numsec = 106985472
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 127467520 Numsec = 106971136

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 120034123776 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-234421648-234441648)...
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff85d8eac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85d8e7b0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff85d8eac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff85d8dcb8, DeviceName: \Device\0000007a\, DriverName: \Driver\USBSTOR\
------------ End ----------
Done!
Performing system, memory and registry scan...
Infected: C:\tmlk.exe --> [Trojan.Agent]
Infected: HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify --> [PUM.Disabled.SecurityCenter]
Infected: HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify --> [PUM.Disabled.SecurityCenter]
Infected: HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify --> [PUM.Disabled.SecurityCenter]
Done!
Scan finished
=======================================


----------



## kevinf80 (Mar 21, 2006)

OK, take MBAR one further step:

1. Open the mbar folder run *mbar.exe* as before....










2. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image:










3. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.)

4. The following image opens, select Next.










5. The following image opens, select Update










6. When the update completes select Next.










7. In the following window ensure "Targets" are ticked. Then select "Scan"










8. If an infection/s are found ensure "Create Restore Point" is checked, then select the *"Cleanup Button"* to remove threats. Or if you are sure any entries should not be kept, just untick them.










9. The Clean up procedure will be Scheduled for process.










10. When scheduling is complete the following image will appear,










11. Select the Yes tab, the system should re-boot to complete the cleaning process.

12. Let me know how your system now responds. Copy and paste the two following logs from the *mbar* folder:

*System - log*
*Mbar - log* Date and time of scan will also be shown, (copy/paste the most recent by date/time)










Thanks,

Kevin...


----------



## hendri1995 (Dec 2, 2012)

Now it dont show again, thank you Kevin
What else i have to do now?

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.000000 GHz
Memory total: 1063444480, free: 305672192

------------ Kernel report ------------
12/02/2012 20:18:10
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\DRIVERS\ACPI.sys
\SystemRoot\system32\DRIVERS\WMILIB.SYS
\SystemRoot\system32\DRIVERS\msisadrv.sys
\SystemRoot\system32\DRIVERS\pci.sys
\SystemRoot\system32\DRIVERS\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\DRIVERS\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\DRIVERS\intelide.sys
\SystemRoot\system32\DRIVERS\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\atapi.sys
\SystemRoot\system32\DRIVERS\ataport.SYS
\SystemRoot\system32\DRIVERS\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\vmstorfl.sys
\SystemRoot\system32\DRIVERS\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\igdkmd32.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\b57nd60x.sys
\SystemRoot\system32\DRIVERS\bcmwl6.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\1394ohci.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\VSTAZL3.SYS
\SystemRoot\system32\DRIVERS\VSTDPV3.SYS
\SystemRoot\system32\DRIVERS\VSTCNXT3.SYS
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\CT_ZTEMT_U_USBSER.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\Wldap32.dll
\Windows\System32\clbcatq.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff85d8eac8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000007a\
Lower Device Object: 0xffffffff85d8dcb8
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
DriverEntry returned 0x0
Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff84f25a90
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xffffffff84ab6908
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
DriverEntry returned 0x0
Function returned 0x0
Downloaded database version: v2012.12.02.02
No address found
Downloaded database version: v2012.12.02.02
Downloaded database version: v2012.11.30.01
Initializing...
Done!
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff84f25a90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff84f25778, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff84f25a90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff84e69918, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff84ab6908, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffff84c313a8, 0xffffffff84f25a90, 0xffffffffb3514340
Lower DeviceData: 0xffffffffa8481490, 0xffffffff84ab6908, 0xffffffff860d6c20
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 47B00E8C

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 20480000

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 20482048 Numsec = 106985472
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 127467520 Numsec = 106971136

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 120034123776 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-234421648-234441648)...
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff85d8eac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85d8e7b0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff85d8eac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff85d8dcb8, DeviceName: \Device\0000007a\, DriverName: \Driver\USBSTOR\
------------ End ----------
Done!
Performing system, memory and registry scan...
Infected: C:\tmlk.exe --> [Trojan.Agent]
Infected: HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify --> [PUM.Disabled.SecurityCenter]
Infected: HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify --> [PUM.Disabled.SecurityCenter]
Infected: HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify --> [PUM.Disabled.SecurityCenter]
Done!
Scan finished
=======================================

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.000000 GHz
Memory total: 1063444480, free: 163647488

------------ Kernel report ------------
12/02/2012 21:54:28
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\DRIVERS\ACPI.sys
\SystemRoot\system32\DRIVERS\WMILIB.SYS
\SystemRoot\system32\DRIVERS\msisadrv.sys
\SystemRoot\system32\DRIVERS\pci.sys
\SystemRoot\system32\DRIVERS\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\DRIVERS\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\DRIVERS\intelide.sys
\SystemRoot\system32\DRIVERS\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\atapi.sys
\SystemRoot\system32\DRIVERS\ataport.SYS
\SystemRoot\system32\DRIVERS\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\vmstorfl.sys
\SystemRoot\system32\DRIVERS\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\igdkmd32.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\b57nd60x.sys
\SystemRoot\system32\DRIVERS\bcmwl6.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\1394ohci.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\VSTAZL3.SYS
\SystemRoot\system32\DRIVERS\VSTDPV3.SYS
\SystemRoot\system32\DRIVERS\VSTCNXT3.SYS
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\CT_ZTEMT_U_USBSER.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\Wldap32.dll
\Windows\System32\clbcatq.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff85d8eac8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000007a\
Lower Device Object: 0xffffffff85d8dcb8
Lower Device Driver Name: \Driver\USBSTOR\
Device already Exists: 0xffffffff86041c20
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff84f25a90
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xffffffff84ab6908
Lower Device Driver Name: \Driver\atapi\
Device already Exists: 0xffffffff860d6c20
Initializing...
Done!
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff84f25a90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff84f25778, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff84f25a90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff84e69918, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff84ab6908, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffff930cb170, 0xffffffff84f25a90, 0xffffffffb3514340
Lower DeviceData: 0xffffffff84cee0d0, 0xffffffff84ab6908, 0xffffffff860d6c20
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 47B00E8C

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 20480000

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 20482048 Numsec = 106985472
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 127467520 Numsec = 106971136

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 120034123776 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-234421648-234441648)...
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff85d8eac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85d8e7b0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff85d8eac8, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff85d8dcb8, DeviceName: \Device\0000007a\, DriverName: \Driver\USBSTOR\
------------ End ----------
Done!
Performing system, memory and registry scan...
Infected: C:\tmlk.exe --> [Trojan.Agent]
Infected: HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify --> [PUM.Disabled.SecurityCenter]
Infected: HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify --> [PUM.Disabled.SecurityCenter]
Infected: HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify --> [PUM.Disabled.SecurityCenter]
Done!
Scan finished
Creating System Restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Removal scheduling successful. System shutdown needed.
System shutdown occured
=======================================

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.000000 GHz
Memory total: 1063444480, free: 573661184

Mbar logs
Malwarebytes Anti-Rootkit 1.1.0.1009
www.malwarebytes.org

Database version: v2012.12.02.02

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Hendri :: HENDRI-PC [administrator]

12/2/2012 10:13:41 PM
mbar-log-2012-12-02 (22-13-41).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: PUP | PUM | P2P
Objects scanned: 26914
Time elapsed: 18 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 3
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Delete on reboot. [5c17704d85d87db9fa8373bc7e866c94]
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Delete on reboot. [e68deecfed70df57770765ca758f6c94]
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Delete on reboot. [165d9d20293439fd047b2d020cf855ab]

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\tmlk.exe (Trojan.Agent) -> Delete on reboot. [2c4715a8520b76c0a8b8f0405fa19f61]

(end)


----------



## kevinf80 (Mar 21, 2006)

OK re-run Combofix, if it ask to update please allow... let me see the new log..


----------



## hendri1995 (Dec 2, 2012)

Argghh, it happens again

This is the new log
ComboFix 12-12-01.02 - Hendri 12/02/2012 22:55:09.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1014.533 [GMT -8:00]
Running from: c:\users\Hendri\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\autorun.inf
c:\users\Hendri\AppData\Local\Temp\axrvi.exe
c:\users\Hendri\AppData\Local\Temp\winyguh.exe
c:\windows\ujnqdb.log
D:\autorun.inf
D:\rmsw.pif
.
.
((((((((((((((((((((((((( Files Created from 2012-11-03 to 2012-12-03 )))))))))))))))))))))))))))))))
.
.
2012-12-03 07:02 . 2012-12-03 07:02	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-12-03 06:19 . 2012-12-03 06:19	99328	----a-w-	C:\tmlk.exe
2012-12-03 04:18 . 2012-12-03 04:18	--------	d-----w-	c:\programdata\Malwarebytes
2012-12-03 01:04 . 2012-12-03 01:04	--------	d-----w-	c:\program files\Trend Micro
2012-12-02 18:39 . 2012-12-02 18:39	--------	d-----w-	c:\program files\GUM8822.tmp
2012-12-02 18:27 . 2012-11-19 09:04	6812136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C0C319C0-81A0-42E5-89F4-E523084A41B3}\mpengine.dll
2012-12-02 18:27 . 2012-05-31 20:25	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-12-02 17:23 . 2012-12-02 17:24	--------	d-----r-	c:\program files\Skype
2012-12-02 17:23 . 2012-12-02 17:23	--------	d-----w-	c:\program files\Common Files\Skype
2012-12-02 17:22 . 2012-12-02 17:56	--------	d-----w-	c:\programdata\Skype
2012-12-02 17:16 . 2009-11-25 19:47	49472	----a-w-	c:\windows\system32\netfxperf.dll
2012-12-02 17:16 . 2009-11-25 19:47	297808	----a-w-	c:\windows\system32\mscoree.dll
2012-12-02 17:16 . 2009-11-25 19:47	99176	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2012-12-02 17:16 . 2009-11-25 19:47	295264	----a-w-	c:\windows\system32\PresentationHost.exe
2012-12-02 17:16 . 2009-11-25 19:47	1130824	----a-w-	c:\windows\system32\dfshim.dll
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft Synchronization Services
2012-12-02 17:05 . 2012-12-02 18:04	--------	d-----w-	c:\program files\Microsoft.NET
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\windows\PCHEALTH
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft Sync Framework
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition
2012-12-02 17:04 . 2012-12-02 17:04	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2012-12-02 16:58 . 2012-12-02 16:58	--------	d-----w-	c:\program files\Microsoft Analysis Services
2012-12-02 16:56 . 2012-12-02 17:09	--------	d-----w-	c:\programdata\Microsoft Help
2012-12-02 16:56 . 2012-12-03 01:04	--------	d-sh--w-	c:\windows\Installer
2012-12-02 16:50 . 2009-07-28 17:41	104704	----a-w-	c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys
2012-12-02 16:49 . 2012-12-02 16:50	--------	d-----w-	c:\program files\Modem AC2726 UI
2012-12-02 16:48 . 2011-03-02 10:43	175616	----a-w-	c:\windows\system32\unrar.dll
2012-12-02 16:48 . 2008-09-24 18:41	839680	----a-w-	c:\windows\system32\lameACM.acm
2012-12-02 16:48 . 2011-07-22 08:00	74752	----a-w-	c:\windows\system32\ff_vfw.dll
2012-12-02 16:48 . 2011-07-16 14:17	151552	----a-w-	c:\windows\system32\ac3acm.acm
2012-12-02 16:48 . 2011-06-24 14:44	243200	----a-w-	c:\windows\system32\xvidvfw.dll
2012-12-02 16:48 . 2011-06-24 14:28	650752	----a-w-	c:\windows\system32\xvidcore.dll
2012-12-02 16:48 . 2010-11-03 18:08	237568	----a-w-	c:\windows\system32\yv12vfw.dll
2012-12-02 16:48 . 2012-12-02 16:48	--------	d-----w-	c:\program files\K-Lite Codec Pack
2012-12-02 16:46 . 2012-12-02 16:46	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-02 16:46 . 2012-12-02 16:46	--------	d-----w-	c:\windows\system32\Macromed
2012-12-02 16:39 . 2012-12-03 06:25	--------	d-----w-	c:\windows\system32\wbem\Performance
2012-12-02 16:36 . 2012-12-02 16:37	--------	d-----w-	c:\users\Hendri
2012-12-02 16:19 . 2012-12-02 16:36	--------	d-----w-	c:\windows\Panther
2012-12-02 01:28 . 2012-12-02 04:41	--------	d-----w-	C:\0b7846108bb474693002544a
2012-12-02 00:54 . 2012-12-02 04:27	--------	d-----w-	C:\[Smad-Cage]
2012-12-02 00:05 . 2012-12-02 04:54	--------	d-----r-	C:\MSOCache
2012-12-01 23:59 . 2012-12-02 16:35	--------	d-----w-	C:\Recovery
2012-12-01 23:40 . 2012-12-01 23:40	--------	d-----w-	C:\Windows.old
2012-12-01 23:39 . 2012-12-02 16:19	--------	d-----w-	C:\Boot
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-03 07:04 . 2012-12-03 07:04	99328	--sh--r-	C:\ciyxq.pif
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-10-20 17956016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-01-22 169344]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
S2 UDisk Monitor;UDisk Monitor;c:\program files\Modem AC2726 UI\bin\MonServiceUDisk.exe [x]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
S3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\DRIVERS\CT_ZTEMT_U_USBSER.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1812936006-1292451050-3836158646-1000Core.job
- c:\users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02 18:39]
.
2012-12-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1812936006-1292451050-3836158646-1000UA.job
- c:\users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02 18:39]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: Interfaces\{92468551-980F-49B8-896C-A17D08C8F264}: NameServer = 10.17.3.245 10.17.125.229
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-{92A08848-BC46-4B35-B545-2113F2010BC8}_is1 - c:\aetherflyff - basilisk\unins000.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\sppsvc.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2012-12-02 23:07:27 - machine was rebooted
ComboFix-quarantined-files.txt 2012-12-03 07:07
ComboFix2.txt 2012-12-03 02:23
.
Pre-Run: 26,426,531,840 bytes free
Post-Run: 25,903,042,560 bytes free
.
- - End Of File - - E36DEC7888B005F843178AE0C2657986


----------



## kevinf80 (Mar 21, 2006)

OK the infection has returned, do this :-

1. Close any open browsers.

2. *Close/disable all anti virus and anti malware programs* so they do not interfere with the running of ComboFix.

3. Open *notepad* and copy/paste the text in the Codebox below into it:


```
KillAll::
ClearJavaCache::
File::
C:\tmlk.exe
C:\ciyxq.pif
Folder::
c:\program files\GUM8822.tmp
C:\[Smad-Cage]
DirLook::
C:\0b7846108bb474693002544a
RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
```
Save this as *CFScript.txt*, and as Type: *All Files* *(*.*)* in the same location as ComboFix.exe



















Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt* which I will require in your next reply.

Next,

Open Malwarebytes, check for updates then run Quick scan. Full instructions follow if Malwarebytes is not installed:

*Malwarebytes* Anti-Malware and save it to your desktop.
*Alernative D/L mirror*
*Alternative D/L mirror*

Double Click mbam-setup.exe to install the application.









Please download
 Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
 If an update is found, it will download and install the latest version.
 Once the program has loaded, select "Perform Quick Scan", then click Scan.
 The scan may take some time to finish,so please be patient.
 When the scan is complete, click OK, then Show Results to view the results.
 Make sure that everything is checked, and click Remove Selected.
 When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
 Please save the log to a location you will remember.
 The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
 Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Let me see those two logs...


----------



## hendri1995 (Dec 2, 2012)

Here is the logs

ComboFix 12-12-01.02 - Hendri 12/02/2012 23:57:35.3.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1014.585 [GMT -8:00]
Running from: c:\users\Hendri\Desktop\ComboFix.exe
Command switches used :: c:\users\Hendri\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"C:\ciyxq.pif"
"C:\tmlk.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\[Smad-Cage]
c:\[smad-cage]\autorun (2).dav
c:\[smad-cage]\autorun.dav
c:\[smad-cage]\iuvjuo.dav
c:\[smad-cage]\keavn.dav
C:\autorun.inf
C:\ciyxq.pif
c:\program files\GUM8822.tmp
C:\tmlk.exe
c:\windows\ujnqdb.log
D:\Autorun.inf
D:\qfcd.pif
.
.
((((((((((((((((((((((((( Files Created from 2012-11-03 to 2012-12-03 )))))))))))))))))))))))))))))))
.
.
2012-12-03 08:02 . 2012-12-03 08:02	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-12-03 04:18 . 2012-12-03 04:18	--------	d-----w-	c:\programdata\Malwarebytes
2012-12-03 01:04 . 2012-12-03 01:04	--------	d-----w-	c:\program files\Trend Micro
2012-12-02 18:27 . 2012-11-19 09:04	6812136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C0C319C0-81A0-42E5-89F4-E523084A41B3}\mpengine.dll
2012-12-02 18:27 . 2012-05-31 20:25	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-12-02 17:23 . 2012-12-02 17:24	--------	d-----r-	c:\program files\Skype
2012-12-02 17:23 . 2012-12-02 17:23	--------	d-----w-	c:\program files\Common Files\Skype
2012-12-02 17:22 . 2012-12-02 17:56	--------	d-----w-	c:\programdata\Skype
2012-12-02 17:16 . 2009-11-25 19:47	49472	----a-w-	c:\windows\system32\netfxperf.dll
2012-12-02 17:16 . 2009-11-25 19:47	297808	----a-w-	c:\windows\system32\mscoree.dll
2012-12-02 17:16 . 2009-11-25 19:47	99176	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2012-12-02 17:16 . 2009-11-25 19:47	295264	----a-w-	c:\windows\system32\PresentationHost.exe
2012-12-02 17:16 . 2009-11-25 19:47	1130824	----a-w-	c:\windows\system32\dfshim.dll
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft Synchronization Services
2012-12-02 17:05 . 2012-12-02 18:04	--------	d-----w-	c:\program files\Microsoft.NET
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\windows\PCHEALTH
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft Sync Framework
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition
2012-12-02 17:04 . 2012-12-02 17:04	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2012-12-02 16:58 . 2012-12-02 16:58	--------	d-----w-	c:\program files\Microsoft Analysis Services
2012-12-02 16:56 . 2012-12-02 17:09	--------	d-----w-	c:\programdata\Microsoft Help
2012-12-02 16:56 . 2012-12-03 01:04	--------	d-sh--w-	c:\windows\Installer
2012-12-02 16:50 . 2009-07-28 17:41	104704	----a-w-	c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys
2012-12-02 16:49 . 2012-12-02 16:50	--------	d-----w-	c:\program files\Modem AC2726 UI
2012-12-02 16:48 . 2011-03-02 10:43	175616	----a-w-	c:\windows\system32\unrar.dll
2012-12-02 16:48 . 2008-09-24 18:41	839680	----a-w-	c:\windows\system32\lameACM.acm
2012-12-02 16:48 . 2011-07-22 08:00	74752	----a-w-	c:\windows\system32\ff_vfw.dll
2012-12-02 16:48 . 2011-07-16 14:17	151552	----a-w-	c:\windows\system32\ac3acm.acm
2012-12-02 16:48 . 2011-06-24 14:44	243200	----a-w-	c:\windows\system32\xvidvfw.dll
2012-12-02 16:48 . 2011-06-24 14:28	650752	----a-w-	c:\windows\system32\xvidcore.dll
2012-12-02 16:48 . 2010-11-03 18:08	237568	----a-w-	c:\windows\system32\yv12vfw.dll
2012-12-02 16:48 . 2012-12-02 16:48	--------	d-----w-	c:\program files\K-Lite Codec Pack
2012-12-02 16:46 . 2012-12-02 16:46	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-02 16:46 . 2012-12-02 16:46	--------	d-----w-	c:\windows\system32\Macromed
2012-12-02 16:39 . 2012-12-03 07:16	--------	d-----w-	c:\windows\system32\wbem\Performance
2012-12-02 16:36 . 2012-12-02 16:37	--------	d-----w-	c:\users\Hendri
2012-12-02 16:19 . 2012-12-02 16:36	--------	d-----w-	c:\windows\Panther
2012-12-02 01:28 . 2012-12-02 04:41	--------	d-----w-	C:\0b7846108bb474693002544a
2012-12-02 00:05 . 2012-12-02 04:54	--------	d-----r-	C:\MSOCache
2012-12-01 23:59 . 2012-12-02 16:35	--------	d-----w-	C:\Recovery
2012-12-01 23:40 . 2012-12-01 23:40	--------	d-----w-	C:\Windows.old
2012-12-01 23:39 . 2012-12-02 16:19	--------	d-----w-	C:\Boot
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\0b7846108bb474693002544a ----
.
2010-03-19 00:51 . 2010-03-19 00:51	74214	------w-	c:\0b7846108bb474693002544a\1025\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	60816	------w-	c:\0b7846108bb474693002544a\1028\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	80970	------w-	c:\0b7846108bb474693002544a\1029\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	77748	------w-	c:\0b7846108bb474693002544a\1030\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	82346	------w-	c:\0b7846108bb474693002544a\1031\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	86284	------w-	c:\0b7846108bb474693002544a\1032\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	77022	------w-	c:\0b7846108bb474693002544a\1035\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	82962	------w-	c:\0b7846108bb474693002544a\1036\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	72076	------w-	c:\0b7846108bb474693002544a\1037\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	86442	------w-	c:\0b7846108bb474693002544a\1038\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	80060	------w-	c:\0b7846108bb474693002544a\1040\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	68226	------w-	c:\0b7846108bb474693002544a\1041\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	65238	------w-	c:\0b7846108bb474693002544a\1042\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	79634	------w-	c:\0b7846108bb474693002544a\1043\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	79296	------w-	c:\0b7846108bb474693002544a\1044\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	82374	------w-	c:\0b7846108bb474693002544a\1045\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	80738	------w-	c:\0b7846108bb474693002544a\1046\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	81482	------w-	c:\0b7846108bb474693002544a\1049\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	77680	------w-	c:\0b7846108bb474693002544a\1053\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	76818	------w-	c:\0b7846108bb474693002544a\1055\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	60684	------w-	c:\0b7846108bb474693002544a\2052\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	80254	------w-	c:\0b7846108bb474693002544a\2070\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	60816	------w-	c:\0b7846108bb474693002544a\3076\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	79996	------w-	c:\0b7846108bb474693002544a\3082\LocalizedData.xml
2010-03-19 00:51 . 2010-03-19 00:51	272046	------w-	c:\0b7846108bb474693002544a\ParameterInfo.xml
2010-03-19 00:51 . 2010-03-19 00:51	77232	------w-	c:\0b7846108bb474693002544a\1033\LocalizedData.xml
2010-03-18 23:10 . 2010-03-18 23:10	93314	------w-	c:\0b7846108bb474693002544a\Extended\Parameterinfo.xml
2010-03-18 19:56 . 2010-03-18 19:56	201796	------w-	c:\0b7846108bb474693002544a\Client\Parameterinfo.xml
2010-03-11 04:29 . 2010-03-11 04:29	7567	------w-	c:\0b7846108bb474693002544a\1025\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	6309	------w-	c:\0b7846108bb474693002544a\1028\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3726	------w-	c:\0b7846108bb474693002544a\1029\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3314	------w-	c:\0b7846108bb474693002544a\1030\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3419	------w-	c:\0b7846108bb474693002544a\1031\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	8876	------w-	c:\0b7846108bb474693002544a\1032\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3702	------w-	c:\0b7846108bb474693002544a\1035\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3526	------w-	c:\0b7846108bb474693002544a\1036\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	6851	------w-	c:\0b7846108bb474693002544a\1037\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	4254	------w-	c:\0b7846108bb474693002544a\1038\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3643	------w-	c:\0b7846108bb474693002544a\1040\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	10125	------w-	c:\0b7846108bb474693002544a\1041\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	12687	------w-	c:\0b7846108bb474693002544a\1042\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3546	------w-	c:\0b7846108bb474693002544a\1043\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3046	------w-	c:\0b7846108bb474693002544a\1044\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	4040	------w-	c:\0b7846108bb474693002544a\1045\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3683	------w-	c:\0b7846108bb474693002544a\1046\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	54456	------w-	c:\0b7846108bb474693002544a\1049\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3865	------w-	c:\0b7846108bb474693002544a\1053\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3859	------w-	c:\0b7846108bb474693002544a\1055\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	5827	------w-	c:\0b7846108bb474693002544a\2052\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	4015	------w-	c:\0b7846108bb474693002544a\2070\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	6309	------w-	c:\0b7846108bb474693002544a\3076\eula.rtf
2010-03-11 04:29 . 2010-03-11 04:29	3069	------w-	c:\0b7846108bb474693002544a\3082\eula.rtf
2010-03-04 03:07 . 2010-03-04 03:07	3188	------w-	c:\0b7846108bb474693002544a\1033\eula.rtf
2009-11-05 06:41 . 2009-11-05 06:41	38898	------w-	c:\0b7846108bb474693002544a\UiInfo.xml
2009-11-05 06:41 . 2009-11-05 06:41	39042	------w-	c:\0b7846108bb474693002544a\Client\UiInfo.xml
2009-11-05 06:41 . 2009-11-05 06:41	39050	------w-	c:\0b7846108bb474693002544a\Extended\UiInfo.xml
2009-11-05 06:41 . 2009-11-05 06:41	30120	------w-	c:\0b7846108bb474693002544a\SetupUi.xsd
2009-08-31 10:50 . 2009-08-31 10:50	41080	------w-	c:\0b7846108bb474693002544a\SplashScreen.bmp
2009-08-31 10:50 . 2009-08-31 10:50	14084	------w-	c:\0b7846108bb474693002544a\Strings.xml
2009-08-31 10:49 . 2009-08-31 10:49	16118	------w-	c:\0b7846108bb474693002544a\DHtmlHeader.html
2009-08-31 10:41 . 2009-08-31 10:41	3628	------w-	c:\0b7846108bb474693002544a\header.bmp
2009-08-31 10:41 . 2009-08-31 10:41	104072	------w-	c:\0b7846108bb474693002544a\watermark.bmp
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-10-20 17956016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-01-22 169344]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
S2 UDisk Monitor;UDisk Monitor;c:\program files\Modem AC2726 UI\bin\MonServiceUDisk.exe [x]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
S3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\DRIVERS\CT_ZTEMT_U_USBSER.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1812936006-1292451050-3836158646-1000Core.job
- c:\users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02 18:39]
.
2012-12-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1812936006-1292451050-3836158646-1000UA.job
- c:\users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02 18:39]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: Interfaces\{92468551-980F-49B8-896C-A17D08C8F264}: NameServer = 10.17.3.245 10.17.125.229
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\taskhost.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\conhost.exe
c:\windows\system32\WUDFHost.exe
.
**************************************************************************
.
Completion time: 2012-12-03 00:07:10 - machine was rebooted
ComboFix-quarantined-files.txt 2012-12-03 08:07
ComboFix2.txt 2012-12-03 07:07
ComboFix3.txt 2012-12-03 02:23
.
Pre-Run: 25,935,634,432 bytes free
Post-Run: 25,869,733,888 bytes free
.
- - End Of File - - 472F2C4B1F6F1D60D5729C9EE4772A99

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Database version: v2012.12.02.02

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Hendri :: HENDRI-PC [administrator]

12/3/2012 7:50:52 AM
mbam-log-2012-12-03 (07-50-52).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 189333
Time elapsed: 6 minute(s), 38 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 3
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\nsil.pif (Trojan.Agent) -> Quarantined and deleted successfully.

(end)


----------



## kevinf80 (Mar 21, 2006)

OK continue with online AV scan, see if we`ve missed anything:

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go Eset web page http://www.eset.com/home/products/online-scanner/ to run an online scanner from ESET.


 Turn off the real time scanner of any existing antivirus program while performing the online scan
 click on the Run ESET Online Scanner button
 Tick the box next to YES, I accept the Terms of Use.
*Click Start*
 When asked, allow the add/on to be installed
*Click Start*
 Make sure that the option Remove found threats is unticked
 Click on Advanced Settings, ensure the options
 Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
*Click Scan*
 wait for the virus definitions to be downloaded
 Wait for the scan to finish
*When the scan is complete*


 If no threats were found
 put a checkmark in "Uninstall application on close"
 close program
 report to me that nothing was found
*If threats were found*


 click on "list of threats found"
 click on "export to text file" and save it as ESET SCAN and save to the desktop
 Click on back
 put a checkmark in "Uninstall application on close"
 click on finish
*close program*
*copy and paste the report here*

Thanks,

Kevin


----------



## hendri1995 (Dec 2, 2012)

Here is the report (so many viruses)
Information: The dwn.exe dont show again
[edit]
When I end a process from task manager, the dwn.exe show again and sometime it's "app.exe" "chrome.exe" and "explorer.exe"

C:\autorun.inf	INF/Autorun.gen worm
C:\nsil.pif	Win32/Sality.NBA virus
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Win32/Sality.NBA virus
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Win32/Sality.NBA virus
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE	Win32/Sality.NBA virus
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\DW\DW20.EXE	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\DW\DWTRIG20.EXE	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Win32/Sality.NBA virus
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\unins000.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\Filters\Haali\gdsmux.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\Tools\dsconfig.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\Tools\graphstudio.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\Tools\mediainfo.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\Tools\SetACL_x86.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\Tools\StatsReader.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\Tools\VobSubStrip.exe	Win32/Sality.NBA virus
C:\Program Files\K-Lite Codec Pack\Tools\Win7DSFilterTweaker.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\mbampt.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\firefox.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\firefox.scr	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.scr	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\mbam-killer.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\rundll32.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe	Win32/Sality.NBA virus
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\BCSSync.exe	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\CLVIEW.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\CNFNOT32.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\excelcnv.exe	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\GRAPH.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\GROOVE.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\GROOVEMN.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\IEContentService.exe	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\INFOPATH.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\MSACCESS.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\MSOUC.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\MSPUB.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\MSQRY32.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\MSTORDB.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\MSTORE.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\OIS.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\SCANPST.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\SELFCERT.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\SETLANG.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\VPREVIEW.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\Wordconv.exe	Win32/Sality.NBA virus
C:\Program Files\Microsoft Office\Office14\1033\ONELEV.EXE	Win32/Sality.NBA virus
C:\Program Files\Modem AC2726 UI\unins000.exe	Win32/Sality.NBA virus
C:\Program Files\Modem AC2726 UI\bin\Installer.exe	Win32/Sality.NBA virus
C:\Program Files\Modem AC2726 UI\bin\ResourceChecker.exe	Win32/Sality.NBA virus
C:\Program Files\Skype\Phone\Skype.exe	Win32/Sality.NBA virus
C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe	Win32/Sality.NBA virus
C:\Program Files\Skype\Toolbars\Skype for Chromium\MSIExecWatcher.exe	Win32/Sality.NBA virus
C:\Program Files\Skype\Updater\Updater.exe	Win32/Sality.NBA virus
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe	Win32/Sality.NBA virus
C:\Qoobox\Quarantine\C\ciyxq.pif.vir	Win32/Sality.NBA virus
C:\Qoobox\Quarantine\C\ggwldv.exe.vir	Win32/Sality.NBA virus
C:\Qoobox\Quarantine\C\tmlk.exe.vir	Win32/Sality.NBA virus
C:\Qoobox\Quarantine\C\Users\Hendri\AppData\Local\temp\axrvi.exe.vir	probably a variant of Win32/Agent.HLU trojan
C:\Qoobox\Quarantine\C\Users\Hendri\AppData\Local\temp\winyguh.exe.vir	Win32/PSW.Agent.VRL trojan
C:\Qoobox\Quarantine\D\keavn.pif.vir	Win32/Sality.NBA virus
C:\Qoobox\Quarantine\D\qfcd.pif.vir	Win32/Sality.NBA virus
C:\Qoobox\Quarantine\D\rmsw.pif.vir	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\old_chrome.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\17.0.963.12\chrome_frame_helper.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\17.0.963.12\chrome_launcher.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\17.0.963.12\Installer\setup.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\23.0.1271.95\chrome_frame_helper.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\23.0.1271.95\chrome_launcher.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\23.0.1271.95\delegate_execute.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\23.0.1271.95\Installer\setup.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.4.0.11328_0\MSIExecWatcher.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleCrashHandler.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleUpdate.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleUpdateBroker.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleUpdateOnDemand.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleUpdateSetup.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\23.0.1271.95\23.0.1271.95_chrome_installer.exe	Win32/Sality.NBA virus
C:\Users\Hendri\AppData\Local\temp\ggrub.exe	probably a variant of Win32/Agent.HLU trojan
C:\Users\Hendri\AppData\Local\temp\pldn.exe	Win32/PSW.Agent.VRL trojan
C:\Users\Hendri\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Desktop\ComboFix.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Desktop\dds.scr	Win32/Sality.NBA virus
C:\Users\Hendri\Desktop\Fd\K-Lite_Codec_Pack_930_Full.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\dotNetFx40_Full_setup.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\mbam-setup-1.65.1.1000.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\mseinstall.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\SysInfo.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\mbar-1.01.0.1009\mbar\fixdamage.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\mbar-1.01.0.1009\mbar\mbar.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\Programs\avg_isct_stb_all_2012_2180_free.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\Programs\csview_rev1016.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\Programs\HC2Setup.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\Programs\iLividSetupV1.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\Programs\MPC-HC.1.6.4.6052.x86.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\Programs\SkypeSetupFull.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\Programs\smadav90.exe	Win32/Sality.NBA virus
C:\Users\Hendri\Downloads\Programs\vlc-2.0.4-win32.exe	Win32/Sality.NBA virus
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\gpvb.exe	probably a variant of Win32/Agent.HLU trojan
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\winxigpgk.exe	Win32/PSW.Agent.VRL trojan
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\ConvertInkStore.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\InkWatson.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\mip.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\pipanel.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\TabTip.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\DVD Maker\DVDMaker.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Internet Explorer\ExtExport.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Internet Explorer\ieinstal.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Internet Explorer\ielowutil.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Internet Explorer\iexplore.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\Chess\Chess.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\FreeCell\FreeCell.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\Hearts\Hearts.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\Mahjong\Mahjong.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\Solitaire\Solitaire.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Defender\MpCmdRun.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Defender\MSASCui.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Journal\Journal.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Journal\PDIALOG.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Mail\wab.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Mail\wabmig.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Mail\WinMail.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\setup_wm.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\wmlaunch.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\wmpconfig.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\WMPDMC.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\wmpenc.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\wmplayer.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\wmpnetwk.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\wmpnscfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\wmprph.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\wmpshare.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Media Player\WMPSideShowGadget.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows NT\Accessories\wordpad.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Photo Viewer\ImagingDevices.exe	Win32/Sality.NBA virus
C:\Windows.old\Program Files\Windows Sidebar\sidebar.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\bfsvc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\explorer.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\fveupdate.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\HelpPane.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\hh.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\notepad.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\regedit.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Boot\PCAT\memtest.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\ehmsas.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\ehprivjob.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\ehrec.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\ehrecvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\ehsched.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\ehshell.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\ehtray.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\ehvid.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\mcGlidHost.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\McrMgr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\mcspad.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\Mcx2Prov.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\McxTask.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\WTVConverter.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\ehome\CreateDisc\SBEServer.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\NETFXSBS10.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v3.5\csc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v3.5\vbc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\servicing\TrustedInstaller.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\servicing\GC32\tzupd.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Setup\SCRIPTS\bie7_inst.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Setup\SCRIPTS\bie7_uninst.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\Speech\Common\sapisvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\AdapterTroubleshooter.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\aitagent.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\alg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\appidcertstorecheck.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\appidpolicyconverter.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\ARP.EXE	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\at.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\AtBroker.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\attrib.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\audiodg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\auditpol.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\autochk.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\autoconv.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\autofmt.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\AxInstUI.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\baaupdate.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\bcdboot.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\bcdedit.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\BdeHdCfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\BdeUISrv.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\BdeUnlockWizard.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\BitLockerWizard.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\BitLockerWizardElev.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\bitsadmin.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\bootcfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\bridgeunattend.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\bthudtask.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\Bubbles.scr	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cacls.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\calc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\CertEnrollCtrl.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\certreq.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\certutil.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\change.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\charmap.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\chglogon.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\chgport.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\chgusr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\chkdsk.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\chkntfs.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\choice.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cipher.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cleanmgr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cliconfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\clip.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cmd.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cmdkey.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cmdl32.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cmmon32.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cmstp.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cofire.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\colorcpl.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\comp.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\compact.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\CompMgmtLauncher.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\ComputerDefaults.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\conhost.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\consent.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\control.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\convert.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\credwiz.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cscript.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\csrss.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\csrstub.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\ctfmon.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cttune.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\cttunesvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dccw.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dcomcnfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\ddodiag.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\Defrag.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DeviceDisplayObjectProvider.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DeviceEject.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DevicePairingWizard.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DeviceProperties.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DFDWiz.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dfrgui.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dialer.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\diantz.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dinotify.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\diskpart.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\diskperf.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\diskraid.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\Dism.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dispdiag.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DisplaySwitch.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\djoin.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dllhost.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dllhst3g.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dnscacheugc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\doskey.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dpapimig.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DpiScaling.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dplaysvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\dpnsvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\driverquery.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\msinfo32.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\notepad.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\winload.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\winresume.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\Boot\winload.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\Boot\winresume.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\com\comrepl.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\com\MigRegDB.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\Dism\DismHost.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_x86_neutral_33717b093227cd8c\BrmfRsmg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_x86_neutral_2d38149df9cd17c4\BrmfRsmg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DriverStore\FileRepository\bth.inf_x86_neutral_e9873718d5894498\fsquirt.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DriverStore\FileRepository\divacx86.inf_x86_neutral_d9558f410186db36\ditrace.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\System32\DriverStore\FileRepository\divacx86.inf_x86_neutral_d9558f410186db36\xlog.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_brmfcmf.inf_31bf3856ad364e35_6.1.7600.16385_none_1368a535778d1ccb\BrmfRsmg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_brmfcwia.inf_31bf3856ad364e35_6.1.7600.16385_none_b52a9eb5ca58cf81\BrmfRsmg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_bth.inf_31bf3856ad364e35_6.1.7600.16385_none_721b1a5f1ce4cd06\fsquirt.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_divacx86.inf_31bf3856ad364e35_6.1.7600.16385_none_cf00ff1b11812601\ditrace.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_divacx86.inf_31bf3856ad364e35_6.1.7600.16385_none_cf00ff1b11812601\xlog.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-a..ion-telemetry-agent_31bf3856ad364e35_6.1.7600.16385_none_d242a800c7f50c3b\aitagent.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_6.1.7600.16385_none_58257acb668f62bc\cacls.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-adaptertroubleshooter_31bf3856ad364e35_6.1.7600.16385_none_d1d79dd7e49a786f\AdapterTroubleshooter.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-alg_31bf3856ad364e35_6.1.7600.16385_none_a8bfa843bc721ead\alg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7600.16385_none_5722666f137ae177\appidcertstorecheck.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7600.16385_none_5722666f137ae177\appidpolicyconverter.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-atbroker_31bf3856ad364e35_6.1.7600.16385_none_cf7705f47fa8cd65\AtBroker.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-at_31bf3856ad364e35_6.1.7600.16385_none_4cd7fa8ce5381b26\at.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7600.16385_none_76761a4a45f3554b\audiodg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-autochkconfigurator_31bf3856ad364e35_6.1.7600.16385_none_1898d1bbe9180b39\chkntfs.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_e1ca436d2314b860\autochk.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-autofmt_31bf3856ad364e35_6.1.7600.16385_none_e5ca93012081ad49\autofmt.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7600.16385_none_d6dba508d240dfc8\AxInstUI.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7600.16385_none_690eed4dee1e338a\winload.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7600.16385_none_690eed4dee1e338a\winresume.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_6.1.7600.16385_none_880152e9067f35bc\bcdedit.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7600.16385_none_d80ba48d65f0f02f\memtest.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7600.16385_none_5afd1055cdfa75b9\winload.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7600.16385_none_5afd1055cdfa75b9\winresume.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_6.1.7600.16385_none_25ead75606e80801\bfsvc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_6.1.7600.16385_none_612c3ab89f77fbff\bcdboot.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_6.1.7600.16385_none_4ce7e7256dbfa16f\bitsadmin.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bootconfig_31bf3856ad364e35_6.1.7600.16385_none_0becd32d7b9ba9e5\bootcfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7600.16385_none_64ef960f3681a8eb\bthudtask.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bubbles_31bf3856ad364e35_6.1.7600.16385_none_6e549c5f2b4536ee\Bubbles.scr	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_6.1.7600.16385_none_e9dfd464f0c2ad1f\comrepl.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_6.1.7600.16385_none_2d26f786c50448ba\MigRegDB.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_6.1.7600.16385_none_8debc8b755a5bae3\CompMgmtLauncher.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-calc_31bf3856ad364e35_6.1.7600.16385_none_a994575e7c0f8d6e\calc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-certificaterequesttool_31bf3856ad364e35_6.1.7600.16385_none_67e6e9a778bbd9d5\certreq.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_b55b5e1094b0283d\certutil.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-charmap_31bf3856ad364e35_6.1.7600.16385_none_f230138205aebc59\charmap.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_c1bcb003ee041301\chkdsk.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-choice_31bf3856ad364e35_6.1.7600.16385_none_c33d412fed16819c\choice.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_acecd57e066c38ac\cipher.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_6d1a8c84bedf66a4\cleanmgr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-clip_31bf3856ad364e35_6.1.7600.16385_none_a7b238407d550501\clip.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-com-complus-ui_31bf3856ad364e35_6.1.7600.16385_none_b07e19d8a98c26cf\dcomcnfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_43fa44d954d596e7\dllhost.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_43fa44d954d596e7\dllhst3g.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7600.16385_none_8ae31ce07bb01ee0\cmd.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-compact_31bf3856ad364e35_6.1.7600.16385_none_f9cb90ee16e61ec6\compact.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_064cf7cf249d0026\ComputerDefaults.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7600.16385_none_74321d74636d5b24\conhost.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-control_31bf3856ad364e35_6.1.7600.16385_none_99424f610bd169de\control.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7600.16385_none_9caba0df09a5c970\autoconv.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7600.16385_none_9caba0df09a5c970\convert.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_6.1.7600.16385_none_87900e038a1ae3d6\cofire.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-credwiz_31bf3856ad364e35_6.1.7600.16385_none_9fb106cecd28b3f9\credwiz.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_58ba39fb456943bd\csrss.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cttunesvr_31bf3856ad364e35_6.1.7600.16385_none_efd12d677fabca7b\cttunesvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cttune_31bf3856ad364e35_6.1.7600.16385_none_b35ae2951fd8adbc\cttune.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..ervicing-management_31bf3856ad364e35_6.1.7600.16385_none_5e7ff93b6f0000b7\Dism.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_6.1.7600.16385_none_2b0a7c288c12b0a5\DismHost.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_c50b5b3967029178\DFDWiz.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_362ce835fe42421b\ddodiag.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-defrag-adminui_31bf3856ad364e35_6.1.7600.16385_none_98ec64e1f19888da\dfrgui.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-defrag-cmdline_31bf3856ad364e35_6.1.7600.16385_none_c75225df27a90f8d\Defrag.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_6f74b7d163601da2\DevicePairingWizard.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-deviceproperties_31bf3856ad364e35_6.1.7600.16385_none_ea20b9269b3c9a2c\DeviceProperties.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_a69c6a8f23f521f3\diantz.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-directx-directplay4_31bf3856ad364e35_6.1.7600.16385_none_76e6c1802136b090\dplaysvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7600.16385_none_78acde382012c2ac\dpnsvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-diskpart_31bf3856ad364e35_6.1.7600.16385_none_68aebb7df7407c35\diskpart.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-diskraid_31bf3856ad364e35_6.1.7600.16385_none_655ffa33f94dc714\diskraid.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-dispdiag_31bf3856ad364e35_6.1.7600.16385_none_44babf78916ac280\dispdiag.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-displayswitch_31bf3856ad364e35_6.1.7600.16385_none_ec98071c85cf09eb\DisplaySwitch.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7600.16385_none_e1b8d300e3acf8dc\dnscacheugc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_7da9291f2ec46948\dpapimig.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-dpiscaling_31bf3856ad364e35_6.1.7600.16385_none_7a1e2959bc43abd5\DpiScaling.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_95f92198f65d354d\driverquery.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.1.7600.16385_none_34003e8d3b4dc79c\McrMgr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcx2prov_31bf3856ad364e35_6.1.7600.16385_none_d86387f77a6469c9\Mcx2Prov.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcxtask_31bf3856ad364e35_6.1.7600.16385_none_5a9d7f2ae4a9228f\McxTask.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehmsas_31bf3856ad364e35_6.1.7600.16385_none_2ae92a9cce326e3f\ehmsas.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehprivjob_31bf3856ad364e35_6.1.7600.16385_none_f4e986db931eeeab\ehprivjob.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehrec_31bf3856ad364e35_6.1.7600.16385_none_4ac9e738b65b791d\ehrec.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehshell_31bf3856ad364e35_6.1.7600.16385_none_3976c0515b3306e5\ehshell.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehtray_31bf3856ad364e35_6.1.7600.16385_none_2aaf63e2ce5cada5\ehtray.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehvid_31bf3856ad364e35_6.1.7600.16385_none_4b3f146eb60f4984\ehvid.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-mcglidhost_31bf3856ad364e35_6.1.7600.16385_none_a9841ba05f8eab34\mcGlidHost.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-mcspad_31bf3856ad364e35_6.1.7600.16385_none_616d9707cc8c9e84\mcspad.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-services-ehrecvr_31bf3856ad364e35_6.1.7600.16385_none_bd3fd42782f1ef9a\ehrecvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-services-ehsched_31bf3856ad364e35_6.1.7600.16385_none_a54954fd9d61ab4b\ehsched.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-wtvconverter_31bf3856ad364e35_6.1.7600.16385_none_4c27af48fd4bae23\WTVConverter.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_009cfaa696afe78b\comp.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-fdddo_31bf3856ad364e35_6.1.7600.16385_none_54bf8f7a944a30ac\DeviceDisplayObjectProvider.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-help-client_31bf3856ad364e35_6.1.7600.16385_none_6beee6458f6a465e\HelpPane.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_c82c4cd5e6101085\hh.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_6.1.7600.16385_none_247621f7aa7542ff\ImagingDevices.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_b346f9b4861b55c2\iexplore.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7600.16385_none_151dac996ae5a654\tzupd.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-icm-dccw_31bf3856ad364e35_6.1.7600.16385_none_1ac50203efd6e328\dccw.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-icm-ui_31bf3856ad364e35_6.1.7600.16385_none_3a2f0d8e0222fc0f\colorcpl.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_8.0.7600.16385_none_2106a98149904819\ielowutil.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_8.0.7600.16385_none_488e5dfb9bdb243c\ExtExport.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_8.0.7600.16385_none_032c767969f7eb6f\ieinstal.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-lua_31bf3856ad364e35_6.1.7600.16385_none_a620b355be1f00e9\consent.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_6.1.7600.16385_none_6ff39cfbb8057a05\cliconfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\attrib.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\doskey.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_6.1.7600.16385_none_c0742954d48af621\wmprph.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..yer-sideshow-gadget_31bf3856ad364e35_6.1.7600.16385_none_27fff9111045b65e\WMPSideShowGadget.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_6.1.7600.16385_none_1ad106c1a14e554e\wmlaunch.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7600.16385_none_0b401942b06d4f06\wmpconfig.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7600.16385_none_0b401942b06d4f06\wmplayer.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7600.16385_none_0b401942b06d4f06\wmpshare.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7600.16385_none_adca1fa537de6f5e\setup_wm.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpenc_31bf3856ad364e35_6.1.7600.16385_none_a3fa8a7d892f3cc9\wmpenc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_c718d071d9c10a2d\auditpol.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.1.7600.16385_none_861b553e4c3473c1\msinfo32.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7600.16385_none_abb2bcfa5b01dea9\msinfo32.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_07c046fe67692e98\bridgeunattend.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-notepadwin_31bf3856ad364e35_6.1.7600.16385_none_42a023025c60a33a\notepad.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_6ef0e39ed15350e4\notepad.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1.7600.16385_none_fde3cf3dd3e16d0d\csrstub.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-o..calmediadisc-wizard_31bf3856ad364e35_6.1.7600.16385_none_1a620ef7a9388190\DVDMaker.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7600.16385_none_60f9d0f46028b3c9\diskperf.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-pnphotplugui_31bf3856ad364e35_6.1.7600.16385_none_e8b787acac120444\DeviceEject.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-pnpui_31bf3856ad364e35_6.1.7600.16385_none_5eade77d8c9d065b\dinotify.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_5ef69594c1d92260\cmdl32.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_5ef69594c1d92260\cmmon32.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_5ef69594c1d92260\cmstp.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedit.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..boxgames-backgammon_31bf3856ad364e35_6.1.7600.16385_none_0a6e67948d2aa502\bckgzm.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_6.1.7600.16385_none_de06b4fbd5b45f78\BitLockerToGo.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..erinboxgames-spades_31bf3856ad364e35_6.1.7600.16385_none_13883bb2626e33de\shvlzm.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..estartup-fverecover_31bf3856ad364e35_6.1.7600.16385_none_4ee6b739366ce92b\BdeUnlockWizard.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..inboxgames-checkers_31bf3856ad364e35_6.1.7600.16385_none_761811ed16821654\chkrzm.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_58481bbdfe2e6164\FreeCell.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..inboxgames-shanghai_31bf3856ad364e35_6.1.7600.16385_none_c07a51d9507d9398\Mahjong.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..iuminboxgames-chess_31bf3856ad364e35_6.1.7600.16385_none_74aaf7f0dfbacf9f\Chess.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_f3e05452c52c6325\Hearts.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..line-user-interface_31bf3856ad364e35_6.1.7600.16385_none_dcbdc8e83e2b98be\cmdkey.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.1.7600.16385_none_828e8a89d6a2ba3d\SpiderSolitaire.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_74f3b07c5d008bde\Solitaire.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..otservicing-utility_31bf3856ad364e35_6.1.7600.16385_none_751b074aed0a5d09\fveupdate.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_a237737f9a82de12\MineSweeper.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_0601d49e5fc57a03\PurblePlace.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_36251cb0347ba7a9\baaupdate.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_6.1.7600.16385_none_a0c7dd7eca510f1b\BdeHdCfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_483ea93961ad86ec\cscript.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7600.16385_none_575cad77ec6bf51f\BitLockerWizard.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7600.16385_none_575cad77ec6bf51f\BitLockerWizardElev.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-securestartup-service_31bf3856ad364e35_6.1.7600.16385_none_647c0a30066b1ab5\BdeUISrv.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7600.16385_none_ceb301e087fbb047\sidebar.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.1.7600.16385_none_1ce85d64ba8de34d\SBEServer.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_6.1.7600.16385_none_027fdd2324e3c2dd\sapisvr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_6.1.7600.16385_none_41c821eeeae8dea2\pipanel.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7600.16385_none_423b458dae59129d\PDIALOG.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\change.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\chglogon.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\chgport.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\chgusr.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_6.1.7600.16385_none_ca77d93bb23f06e1\mip.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_6.1.7600.16385_none_0d580453d317a99d\FlickLearningWizard.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_3f82691927a7cab9\ConvertInkStore.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_3f82691927a7cab9\InputPersonalization.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_3f82691927a7cab9\ShapeCollector.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tabletpc-inkwatson_31bf3856ad364e35_6.1.7600.16385_none_082d7f15624f2ec5\InkWatson.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_6.1.7600.16385_none_11656be9d8d5e28f\TabTip.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7600.16385_none_1787de7505ebcb56\Journal.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_e4102eada7ea2fc8\dialer.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7600.16385_none_329d49cdb031b824\ARP.EXE	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-trustedinstaller_31bf3856ad364e35_6.1.7600.16385_none_90e389a7ae7a4b6c\TrustedInstaller.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-unattendedjoin_31bf3856ad364e35_6.1.7600.16385_none_b2eb3ac2ce28339d\djoin.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7600.16385_none_427fb3a438e633d3\wab.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7600.16385_none_427fb3a438e633d3\wabmig.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_6.1.7600.16385_none_ee39c6ec58b46e4f\WMPDMC.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7600.16385_none_035d21f62fe736df\wmpnetwk.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wmpnss-ux_31bf3856ad364e35_6.1.7600.16385_none_b79b19341aca35eb\wmpnscfg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wordpad_31bf3856ad364e35_6.1.7600.16385_none_2d90cf56ce391a32\wordpad.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7600.16385_none_f36d0d15effa7588\CertEnrollCtrl.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_99be0d55273fde9a\AppLaunch.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_e6af0acbde467b7b\aspnet_regiis.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_55a43aca7f285819\aspnet_state.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_99702545489547b3\aspnet_wp.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_d797745a4a1a7c82\ilasm.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_d2fff1dae966863c\csc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7600.16385_none_ba476986f05abc65\cvtres.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_a223bd3dd785391a\dw20.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_f47d7472a4c4e67e\mscorsvw.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_6.1.7600.16385_none_3b6545980f480049\NETFXSBS10.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_4c4430e106efd828\ngen.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx-vb_compiler_b03f5f7f11d50a3a_6.1.7600.16385_none_14765e50628d5d65\vbc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_58326e688d4907c6\WFServicesReg.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx35linq-csharp_31bf3856ad364e35_6.1.7600.16385_none_1702052d757d6e3d\csc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_6.1.7600.16385_none_95d8aaba50b43dd9\vbc.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_579306edb982ae36\MpCmdRun.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_579306edb982ae36\MSASCui.exe	Win32/Sality.NBA virus
C:\Windows.old\Windows\winsxs\x86_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_6.1.7600.16385_none_fff7b2337e797fdc\SMConfigInstaller.exe	Win32/Sality.NBA virus
C:\Windows.old.000\Documents and Settings\Hendri\AppData\Local\Application Data\Temp\_iu14D2N.tmp	Win32/Sality.NBA virus
C:\Windows.old.000\Documents and Settings\Hendri\AppData\Local\Temp\_iu14D2N.tmp	Win32/Sality.NBA virus
C:\Windows.old.000\Documents and Settings\Hendri\Local Settings\Temp\_iu14D2N.tmp	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\DW\DW20.EXE	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\DW\DWTRIG20.EXE	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Win32/Sality.NBA virus
C:\Windows.old.000\Program Files\Microsoft Office\Office14\BCSSync.exe	Win32/Sality.NBA virus
C:\Windows.old.000\Users\Hendri\AppData\Local\Temp\_iu14D2N.tmp	Win32/Sality.NBA virus
C:\Windows.old.000\Users\Hendri\Local Settings\Temp\_iu14D2N.tmp	Win32/Sality.NBA virus
D:\autorun.inf	INF/Autorun.gen worm
D:\rcjy.exe	Win32/Sality.NBA virus
D:\All game\Flash\Alpine Escape.exe	Win32/Sality.NBA virus
D:\All game\Flash\Among the Clouds.exe	Win32/Sality.NBA virus
D:\All game\Flash\Anjing & Kucing.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Ball Punch.exe	Win32/Sality.NBA virus
D:\All game\Flash\Balloons.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Bersih Kamar.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Bowling.exe	Win32/Sality.NBA virus
D:\All game\Flash\Cari Beda.exe	Win32/Sality.NBA virus
D:\All game\Flash\Cowboy.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Disco.exe	Win32/Sality.NBA virus
D:\All game\Flash\EGGS.EXE	Win32/Sality.NBA virus
D:\All game\Flash\EverythingisUnexpectable.exe	Win32/Sality.NBA virus
D:\All game\Flash\FRIEND.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Helicopter.exe	Win32/Sality.NBA virus
D:\All game\Flash\Iwak Hiu.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Iwak Koki.exe	Win32/Sality.NBA virus
D:\All game\Flash\Judi Batu.exe	Win32/Sality.NBA virus
D:\All game\Flash\Koleksi Kentut .exe	Win32/Sality.NBA virus
D:\All game\Flash\Kucing.exe	Win32/Sality.NBA virus
D:\All game\Flash\Mancik.EXE	Win32/Sality.NBA virus
D:\All game\Flash\MILLIO~1.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Nyebrang bae.exe	Win32/Sality.NBA virus
D:\All game\Flash\Pencak Silat.exe	Win32/Sality.NBA virus
D:\All game\Flash\Ping-pong.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Pinguin.exe	Win32/Sality.NBA virus
D:\All game\Flash\Puzzle Badut.exe	Win32/Sality.NBA virus
D:\All game\Flash\Puzzle.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Sky Es.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Sleep Walk.exe	Win32/Sality.NBA virus
D:\All game\Flash\Sniper.exe	Win32/Sality.NBA virus
D:\All game\Flash\snowfight.exe	Win32/Sality.NBA virus
D:\All game\Flash\Suntik Boyok.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Swordman.exe	Win32/Sality.NBA virus
D:\All game\Flash\Telok Ayam.exe	Win32/Sality.NBA virus
D:\All game\Flash\Test IQ.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Thief.EXE	Win32/Sality.NBA virus
D:\All game\Flash\Tweety.exe	Win32/Sality.NBA virus
D:\All game\Flash\Use Your Mind.exe	Win32/Sality.NBA virus
D:\All game\Flash\WhipTheWorker.exe	Win32/Sality.NBA virus
D:\All game\Flash\Winnie the Pooh.exe	Win32/Sality.NBA virus
D:\All game\Plants vs. Zombies\PlantsVsZombies.exe	Win32/Sality.NBA virus
D:\All game\Plants vs. Zombies\PopUninstall.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\Biologi\Bu Ana\PENCEMARAN\autorun.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\Biologi\Bu Ana\PENCEMARAN\pencemaran.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\Teddy\Insaniquarium Deluxe\GameInstaller.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\Teddy\Insaniquarium Deluxe\Insaniquarium.scr	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\audacity-win-unicode-1.3.13.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\AutoGordianKnot.2.55.Setup_2.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\ChromeSetup.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\Convert-Powerpoint-to-Video-Lite-3.5Free-download.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\EM_PowerPoint_Video_Converter_setup.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\freevideocutter_setup.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\IE9-Windows7-x86-enu.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\install_flash_player.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\leawo_ppt2video_free.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\mp3cutter.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\msgr10us.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\msgr11us.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\speedyfox.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\VideoCutterSetup.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\winamp561_full_emusic-7plus_all.exe	Win32/Sality.NBA virus
D:\Dokumen Hendri\X.3\Program\wlsetup-web.exe	Win32/Sality.NBA virus
D:\KeyGen Ulead 11\Crack - Ulead VideoStudio 11 Plus.exe	Win32/Sality.NBA virus
D:\Novita\Accounting18\drvwd32.exe	Win32/Sality.NBA virus
D:\Novita\Accounting18\drvxl32.exe	Win32/Sality.NBA virus
D:\Novita\Accounting18\Myob.exe	Win32/Sality.NBA virus
D:\Novita\Accounting18\MyobPOpt.exe	Win32/Sality.NBA virus
D:\Novita\Accounting18\MYOBUpg.exe	Win32/Sality.NBA virus
D:\Novita\Accounting18\TemplatesUpgrader.exe	Win32/Sality.NBA virus
D:\Novita\Accounting18\ODBCDirect8\setup.exe	Win32/Sality.NBA virus
D:\Novita\Accounting18\OutlookSync\MYOBConnection.exe	Win32/Sality.NBA virus
D:\Novita\Accounting18\OutlookSync\OutlookSync.exe	Win32/Sality.NBA virus
D:\Novita\myob12\drvwd32.exe	Win32/Sality.NBA virus
D:\Novita\myob12\drvwp32.exe	Win32/Sality.NBA virus
D:\Novita\myob12\drvxl32.exe	Win32/Sality.NBA virus
D:\Novita\myob12\MyobOpt.exe	Win32/Sality.NBA virus
D:\Novita\myob12\MYOBUPG.exe	Win32/Sality.NBA virus
D:\Novita\myob12\TemplatesUpgrader.exe	Win32/Sality.NBA virus
D:\Novita\myob12\BASlink\BASlink.exe	Win32/Sality.NBA virus
D:\Novita\myob12\BASlink\BASup.exe	Win32/Sality.NBA virus
D:\Novita\myob12\ODBCDirect2\Setup.exe	Win32/Sality.NBA virus
Operating memory	multiple threats


----------



## kevinf80 (Mar 21, 2006)

Wow that is a lot of infected files, best way to deal with that is to run ESET online AV once more, this time please make sure that the option *Remove found threats* *is ticked*

Post the new log...

When that is finished, re-run Combofix, if it asks to update please allow it. Post that log also....

Kevin


----------



## hendri1995 (Dec 2, 2012)

Done, here is the log
Next? (Info: the problem dont show again)
Edit: It show again

C:\autorun.inf	INF/Autorun.gen worm	cleaned by deleting (after the next restart) - quarantined
C:\nsil.pif	Win32/Sality.NBA virus	cleaned by deleting - quarantined
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\DW\DW20.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\DW\DWTRIG20.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\ESET\ESET Online Scanner\ESETSmartInstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScannerA.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\unins000.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\Filters\Haali\gdsmux.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\Tools\dsconfig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\Tools\graphstudio.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\Tools\mediainfo.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\Tools\SetACL_x86.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\Tools\StatsReader.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\Tools\VobSubStrip.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\K-Lite Codec Pack\Tools\Win7DSFilterTweaker.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\mbampt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\firefox.exe	Win32/Sality.NBA virus cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\firefox.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\mbam-killer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\rundll32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\BCSSync.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\CLVIEW.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\CNFNOT32.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\excelcnv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\GRAPH.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\GROOVE.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\GROOVEMN.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\IEContentService.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\INFOPATH.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\MSACCESS.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\MSOUC.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\MSPUB.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\MSQRY32.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\MSTORDB.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\MSTORE.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\OIS.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\SCANPST.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\SELFCERT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\SETLANG.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\VPREVIEW.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\Wordconv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Microsoft Office\Office14\1033\ONELEV.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Modem AC2726 UI\unins000.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Modem AC2726 UI\bin\App.exe	Win32/Sality.NBA virus	cleaned (after the next restart) - quarantined
C:\Program Files\Modem AC2726 UI\bin\Installer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Modem AC2726 UI\bin\ResourceChecker.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Skype\Phone\Skype.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Skype\Toolbars\Skype for Chromium\MSIExecWatcher.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Skype\Updater\Updater.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Qoobox\Quarantine\C\ciyxq.pif.vir	Win32/Sality.NBA virus	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\ggwldv.exe.vir	Win32/Sality.NBA virus	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\tmlk.exe.vir	Win32/Sality.NBA virus	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\Hendri\AppData\Local\temp\axrvi.exe.vir	probably a variant of Win32/Agent.HLU trojan	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\Hendri\AppData\Local\temp\winyguh.exe.vir	Win32/PSW.Agent.VRL trojan	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\D\keavn.pif.vir	Win32/Sality.NBA virus	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\D\qfcd.pif.vir	Win32/Sality.NBA virus	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\D\rmsw.pif.vir	Win32/Sality.NBA virus	cleaned by deleting - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe	Win32/Sality.NBA virus	cleaned (after the next restart) - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\old_chrome.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\17.0.963.12\chrome_frame_helper.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\17.0.963.12\chrome_launcher.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\17.0.963.12\Installer\setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\23.0.1271.95\chrome_frame_helper.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\23.0.1271.95\chrome_launcher.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\23.0.1271.95\delegate_execute.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\23.0.1271.95\Installer\setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.4.0.11328_0\MSIExecWatcher.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleCrashHandler.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleUpdate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleUpdateBroker.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleUpdateOnDemand.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Update\1.3.21.129\GoogleUpdateSetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\23.0.1271.95\23.0.1271.95_chrome_installer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\AppData\Local\temp\lwykh.exe	Win32/PSW.Agent.VRL trojan	cleaned by deleting - quarantined
C:\Users\Hendri\AppData\Local\temp\winquuw.exe	probably a variant of Win32/Agent.HLU trojan	cleaned by deleting - quarantined
C:\Users\Hendri\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Desktop\ComboFix.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Desktop\dds.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Desktop\Fd\K-Lite_Codec_Pack_930_Full.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\dotNetFx40_Full_setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\mbam-setup-1.65.1.1000.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\mseinstall.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\SysInfo.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\mbar-1.01.0.1009\mbar\fixdamage.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\mbar-1.01.0.1009\mbar\mbar.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\Programs\HC2Setup.exe	a variant of Win32/Somoto.A application	cleaned - quarantined
C:\Users\Hendri\Downloads\Programs\MPC-HC.1.6.4.6052.x86.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\Programs\SkypeSetupFull.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\Programs\smadav90.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Users\Hendri\Downloads\Programs\vlc-2.0.4-win32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\gpvb.exe	probably a variant of Win32/Agent.HLU trojan	cleaned by deleting - quarantined
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\winxigpgk.exe	Win32/PSW.Agent.VRL trojan	cleaned by deleting - quarantined
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\ConvertInkStore.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\InkWatson.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\mip.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\pipanel.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Common Files\microsoft shared\ink\TabTip.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\DVD Maker\DVDMaker.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Internet Explorer\ExtExport.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Internet Explorer\ieinstal.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Internet Explorer\ielowutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Internet Explorer\iexplore.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\Chess\Chess.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\FreeCell\FreeCell.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\Hearts\Hearts.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\Mahjong\Mahjong.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\Solitaire\Solitaire.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Defender\MpCmdRun.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Defender\MSASCui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Journal\Journal.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Journal\PDIALOG.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Mail\wab.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Mail\wabmig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Mail\WinMail.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\setup_wm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\wmlaunch.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\wmpconfig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\WMPDMC.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\wmpenc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\wmplayer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\wmpnetwk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\wmpnscfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\wmprph.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\wmpshare.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Media Player\WMPSideShowGadget.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows NT\Accessories\wordpad.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Photo Viewer\ImagingDevices.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Program Files\Windows Sidebar\sidebar.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\bfsvc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\explorer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\fveupdate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\HelpPane.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\hh.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\notepad.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\regedit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\twunk_32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winhlp32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\write.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Boot\PCAT\memtest.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\ehmsas.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\ehprivjob.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\ehrec.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\ehrecvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\ehsched.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\ehshell.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\ehtray.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\ehvid.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\mcGlidHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\McrMgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\mcspad.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\Mcx2Prov.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\McxTask.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\WTVConverter.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\ehome\CreateDisc\SBEServer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\NETFXSBS10.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v3.5\csc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v3.5\vbc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\servicing\TrustedInstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\servicing\GC32\tzupd.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Setup\SCRIPTS\bie7_inst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Setup\SCRIPTS\bie7_uninst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\Speech\Common\sapisvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\AdapterTroubleshooter.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\aitagent.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\alg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\appidcertstorecheck.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\appidpolicyconverter.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ARP.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\at.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\AtBroker.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\attrib.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\audiodg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\auditpol.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\autochk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\autoconv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\autofmt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\AxInstUI.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\baaupdate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\bcdboot.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\bcdedit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\BdeHdCfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\BdeUISrv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\BdeUnlockWizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\BitLockerWizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\BitLockerWizardElev.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\bitsadmin.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\bootcfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\bridgeunattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\bthudtask.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Bubbles.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cacls.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\calc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\CertEnrollCtrl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\certreq.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\certutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\change.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\charmap.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\chglogon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\chgport.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\chgusr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\chkdsk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\chkntfs.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\choice.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cipher.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cleanmgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cliconfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\clip.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cmd.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cmdkey.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cmdl32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cmmon32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cmstp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cofire.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\colorcpl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\comp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\compact.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\CompMgmtLauncher.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ComputerDefaults.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\conhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\consent.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\control.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\convert.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\credwiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cscript.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\csrss.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\csrstub.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ctfmon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cttune.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\cttunesvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dccw.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dcomcnfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ddodiag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Defrag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DeviceDisplayObjectProvider.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DeviceEject.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DevicePairingWizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DeviceProperties.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DFDWiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dfrgui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dialer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\diantz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dinotify.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\diskpart.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\diskperf.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\diskraid.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Dism.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dispdiag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DisplaySwitch.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\djoin.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dllhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dllhst3g.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dnscacheugc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\doskey.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dpapimig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DpiScaling.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dplaysvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dpnsvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\driverquery.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\drvinst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dvdplay.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dvdupgrd.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dwm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DWWIN.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\dxdiag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Dxpserver.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Eap3Host.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\efsui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\EhStorAuthn.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\esentutl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\eudcedit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\eventcreate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\eventvwr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\expand.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\extrac32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\fc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\find.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\findstr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\finger.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\fixmapi.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\fltMC.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\fontview.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\forfiles.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\fsutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ftp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\fvenotify.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\fveprompt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\FXSCOVER.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\FXSSVC.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\FXSUNATD.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\getmac.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\GettingStarted.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\gpresult.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\gpscript.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\gpupdate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\grpconv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\hdwwiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\help.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\HOSTNAME.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\hwrcomp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\hwrreg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\icacls.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\icardagt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\icsunattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ie4uinit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ieUnatt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\iexpress.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\InfDefaultInstall.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ipconfig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\irftp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\iscsicli.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\iscsicpl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\isoburn.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\klist.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ksetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ktmutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\label.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\LocationNotifications.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Locator.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\lodctr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\logagent.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\logman.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\logoff.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\LogonUI.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\lpksetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\lpremove.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\lsass.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\lsm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Magnify.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\makecab.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\manage-bde.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mblctr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mcbuilder.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mctadmin.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\MdRes.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\MdSched.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mfpmp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\MigAutoPlay.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mmc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mobsync.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mountvol.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mpnotify.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\MRINFO.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\msconfig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\msdt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\msdtc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\msfeedssync.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\msg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mshta.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\msiexec.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\msinfo32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mspaint.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\msra.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mstsc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\mtstocom.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\MuiUnattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\MultiDigiMon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Mystify.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\NAPSTAT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\nbtstat.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ndadmin.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\net.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\net1.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\netbtugc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\netcfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\netiougc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Netplwiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\NetProj.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\netsh.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\NETSTAT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\newdev.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\nltest.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\notepad.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\nslookup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ntprint.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ntvdm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ocsetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\odbcad32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\odbcconf.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\openfiles.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\OptionalFeatures.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\osk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\p2phost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PATHPING.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\pcalua.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\pcaui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\pcawrk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\pcwrun.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\perfmon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PhotoScreensaver.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PING.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PkgMgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\plasrv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PnPUnattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PnPutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\poqexec.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\powercfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PresentationHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PresentationSettings.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\prevhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\print.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PrintBrmUi.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\printfilterpipelinesvc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\PrintIsolationHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\printui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\proquota.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\psr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\qappsrv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\qprocess.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\query.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\quser.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\qwinsta.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rasautou.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rasdial.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\raserver.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rasphone.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rdpclip.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rdpinit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rdpshell.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rdpsign.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rdrleakdiag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ReAgentc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\recdisc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\recover.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\reg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\regedt32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\regini.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\RegisterIEPKEYs.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\regsvr32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rekeywiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\relog.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\RelPost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\repair-bde.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\replace.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\reset.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\resmon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Ribbons.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\RMActivate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\RMActivate_isv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\RMActivate_ssp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\RMActivate_ssp_isv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\RmClient.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Robocopy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ROUTE.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\RpcPing.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rrinstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rstrui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\runas.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rundll32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\RunLegacyCPLElevated.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\runonce.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\rwinsta.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sbunattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\schtasks.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\scrnsave.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sdbinst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sdchange.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sdclt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sdiagnhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SearchFilterHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SearchIndexer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SearchProtocolHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SecEdit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\secinit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\services.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sethc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SetIEInstalledDate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\setspn.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\setupcl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\setupSNK.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\setupugc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\setx.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sfc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\shadow.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\shrpubw.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\shutdown.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sigverif.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\slui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\smss.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SndVol.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SnippingTool.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\snmptrap.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sort.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SoundRecorder.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\spinstall.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\spoolsv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sppsvc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\srdelayed.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ssText3d.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\StikyNot.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\subst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\svchost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sxstrace.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SyncHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\syskey.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\systeminfo.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SystemPropertiesAdvanced.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SystemPropertiesComputerName.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SystemPropertiesDataExecutionPrevention.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SystemPropertiesHardware.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SystemPropertiesPerformance.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SystemPropertiesProtection.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\SystemPropertiesRemote.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\systray.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\tabcal.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\takeown.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\TapiUnattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\taskeng.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\taskhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\taskkill.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\tasklist.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\taskmgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\tcmsetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\TCPSVCS.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\timeout.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\TpmInit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\tracerpt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\TRACERT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\tscon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\tsdiscon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\tskill.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\TSTheme.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\TSWbPrxy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\typeperf.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\tzutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\ucsvc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\UI0Detect.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\unlodctr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\unregmp2.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\upnpcont.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\UserAccountControlSettings.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\userinit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Utilman.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\VaultCmd.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\VaultSysUi.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wecutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\WerFault.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\WerFaultSecure.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wermgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wevtutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wextract.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\WFS.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\where.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\whoami.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wiaacmgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wimserv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\WindowsAnytimeUpgradeResults.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wininit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\winload.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\winlogon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\winresume.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\winrs.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\winrshost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\WinSAT.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\winver.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wisptis.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wksprt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wlanext.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wlrmdr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\WPDShextAutoplay.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wpnpinst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\write.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wscript.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\WSManHTTPConfig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wsmprovhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wsqmcons.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wuapp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wuauclt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\WUDFHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\wusa.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\xcopy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\xpsrchvw.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\xwizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Boot\winload.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Boot\winresume.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\com\comrepl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\com\MigRegDB.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Dism\DismHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_x86_neutral_33717b093227cd8c\BrmfRsmg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_x86_neutral_2d38149df9cd17c4\BrmfRsmg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DriverStore\FileRepository\bth.inf_x86_neutral_e9873718d5894498\fsquirt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DriverStore\FileRepository\divacx86.inf_x86_neutral_d9558f410186db36\ditrace.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DriverStore\FileRepository\divacx86.inf_x86_neutral_d9558f410186db36\xlog.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\DriverStore\FileRepository\wvmic.inf_x86_neutral_35364de008700f90\vmicsvc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\IMEJP10\IMJPDADM.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\IMEJP10\IMJPDCT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\IMEJP10\IMJPDSVR.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\IMEJP10\IMJPMGR.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\IMEJP10\imjppdmg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\IMEJP10\IMJPUEX.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\IMEJP10\imjpuexc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\IMESC5\IMSCPROP.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\IMETC10\IMTCPROP.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\shared\IMCCPHR.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\IME\shared\IMEPADSV.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\migwiz\mighost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\migwiz\MigSetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\migwiz\migwiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\migwiz\PostMig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\oobe\audit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\oobe\msoobe.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\oobe\oobeldr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\oobe\Setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\oobe\setupsqm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\oobe\windeploy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Speech\SpeechUX\SpeechUXTutorial.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\Speech\SpeechUX\SpeechUXWiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\spool\tools\PrintBrm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\spool\tools\PrintBrmEngine.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\sysprep\sysprep.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_brmfcmf.inf_31bf3856ad364e35_6.1.7600.16385_none_1368a535778d1ccb\BrmfRsmg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_brmfcwia.inf_31bf3856ad364e35_6.1.7600.16385_none_b52a9eb5ca58cf81\BrmfRsmg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_bth.inf_31bf3856ad364e35_6.1.7600.16385_none_721b1a5f1ce4cd06\fsquirt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_divacx86.inf_31bf3856ad364e35_6.1.7600.16385_none_cf00ff1b11812601\ditrace.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_divacx86.inf_31bf3856ad364e35_6.1.7600.16385_none_cf00ff1b11812601\xlog.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_eventviewersettings_31bf3856ad364e35_6.1.7600.16385_none_f4ce2e2a6506b973\eventvwr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.1.7600.16385_none_81d82fe9c216eb89\pcaui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_339cdc37847a979b\pcalua.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_339cdc37847a979b\pcawrk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-a..ce-useractionrecord_31bf3856ad364e35_6.1.7600.16385_none_32c4b0bc55387f75\psr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7600.16385_none_d4e759e1ae0d6c34\sdbinst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-a..ime-upgrade-results_31bf3856ad364e35_6.1.7600.16385_none_c38ecec78cc7619a\WindowsAnytimeUpgradeResults.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-a..ion-telemetry-agent_31bf3856ad364e35_6.1.7600.16385_none_d242a800c7f50c3b\aitagent.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_6.1.7600.16385_none_58257acb668f62bc\cacls.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-adaptertroubleshooter_31bf3856ad364e35_6.1.7600.16385_none_d1d79dd7e49a786f\AdapterTroubleshooter.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-alg_31bf3856ad364e35_6.1.7600.16385_none_a8bfa843bc721ead\alg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7600.16385_none_5722666f137ae177\appidcertstorecheck.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-appid_31bf3856ad364e35_6.1.7600.16385_none_5722666f137ae177\appidpolicyconverter.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-atbroker_31bf3856ad364e35_6.1.7600.16385_none_cf7705f47fa8cd65\AtBroker.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-at_31bf3856ad364e35_6.1.7600.16385_none_4cd7fa8ce5381b26\at.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7600.16385_none_76761a4a45f3554b\audiodg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_6.1.7600.16385_none_c5fec78a68cd9515\SndVol.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-authentication-logonui_31bf3856ad364e35_6.1.7600.16385_none_656968b1d48c4023\LogonUI.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-autochkconfigurator_31bf3856ad364e35_6.1.7600.16385_none_1898d1bbe9180b39\chkntfs.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_e1ca436d2314b860\autochk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-autofmt_31bf3856ad364e35_6.1.7600.16385_none_e5ca93012081ad49\autofmt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7600.16385_none_d6dba508d240dfc8\AxInstUI.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7600.16385_none_690eed4dee1e338a\winload.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7600.16385_none_690eed4dee1e338a\winresume.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_6.1.7600.16385_none_880152e9067f35bc\bcdedit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7600.16385_none_d80ba48d65f0f02f\memtest.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7600.16385_none_5afd1055cdfa75b9\winload.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7600.16385_none_5afd1055cdfa75b9\winresume.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_6.1.7600.16385_none_25ead75606e80801\bfsvc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_17330d9420bf24e8\expand.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_6.1.7600.16385_none_612c3ab89f77fbff\bcdboot.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_6.1.7600.16385_none_4ce7e7256dbfa16f\bitsadmin.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bootconfig_31bf3856ad364e35_6.1.7600.16385_none_0becd32d7b9ba9e5\bootcfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7600.16385_none_64ef960f3681a8eb\bthudtask.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-bubbles_31bf3856ad364e35_6.1.7600.16385_none_6e549c5f2b4536ee\Bubbles.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_6.1.7600.16385_none_e9dfd464f0c2ad1f\comrepl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_6.1.7600.16385_none_2d26f786c50448ba\MigRegDB.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_6.1.7600.16385_none_8debc8b755a5bae3\CompMgmtLauncher.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-calc_31bf3856ad364e35_6.1.7600.16385_none_a994575e7c0f8d6e\calc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-certificaterequesttool_31bf3856ad364e35_6.1.7600.16385_none_67e6e9a778bbd9d5\certreq.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_b55b5e1094b0283d\certutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-charmap_31bf3856ad364e35_6.1.7600.16385_none_f230138205aebc59\charmap.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_c1bcb003ee041301\chkdsk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-choice_31bf3856ad364e35_6.1.7600.16385_none_c33d412fed16819c\choice.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_acecd57e066c38ac\cipher.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_6d1a8c84bedf66a4\cleanmgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-clip_31bf3856ad364e35_6.1.7600.16385_none_a7b238407d550501\clip.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_e97e2f6c50a1c3c0\mtstocom.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-com-complus-ui_31bf3856ad364e35_6.1.7600.16385_none_b07e19d8a98c26cf\dcomcnfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.1.7600.16385_none_19295908c15690f3\msdtc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_43fa44d954d596e7\dllhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_43fa44d954d596e7\dllhst3g.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-commandlinehelp_31bf3856ad364e35_6.1.7600.16385_none_d4018bc76a8b37d9\help.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7600.16385_none_8ae31ce07bb01ee0\cmd.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-compact_31bf3856ad364e35_6.1.7600.16385_none_f9cb90ee16e61ec6\compact.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_064cf7cf249d0026\ComputerDefaults.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7600.16385_none_74321d74636d5b24\conhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-control_31bf3856ad364e35_6.1.7600.16385_none_99424f610bd169de\control.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7600.16385_none_9caba0df09a5c970\autoconv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7600.16385_none_9caba0df09a5c970\convert.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7600.16385_none_76d801598e3f8e76\drvinst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_6.1.7600.16385_none_87900e038a1ae3d6\cofire.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-credwiz_31bf3856ad364e35_6.1.7600.16385_none_9fb106cecd28b3f9\credwiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_58ba39fb456943bd\csrss.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cttunesvr_31bf3856ad364e35_6.1.7600.16385_none_efd12d677fabca7b\cttunesvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cttune_31bf3856ad364e35_6.1.7600.16385_none_b35ae2951fd8adbc\cttune.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..-japanese-migration_31bf3856ad364e35_6.1.7600.16385_none_0e3c9ce5e73a7257\imjppdmg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7600.16385_none_ed079508d36e3f2d\IMJPDADM.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7600.16385_none_ed079508d36e3f2d\IMJPDCT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7600.16385_none_ed079508d36e3f2d\IMJPUEX.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7600.16385_none_0b13a50be22df60f\imjpuexc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..ervicing-management_31bf3856ad364e35_6.1.7600.16385_none_5e7ff93b6f0000b7\Dism.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_6.1.7600.16385_none_9ce7e6af56972b63\WUDFHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7600.16385_none_3a62984e00849735\IMEPADSV.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_6.1.7600.16385_none_2b0a7c288c12b0a5\DismHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_c50b5b3967029178\DFDWiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7600.16385_none_8d79ea381e8590a8\dwm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_6f41b396eefb7580\IMJPDSVR.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_6f41b396eefb7580\IMJPMGR.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_6.1.7600.16385_none_2399ee55bf178e41\dxdiag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_362ce835fe42421b\ddodiag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-defrag-adminui_31bf3856ad364e35_6.1.7600.16385_none_98ec64e1f19888da\dfrgui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-defrag-cmdline_31bf3856ad364e35_6.1.7600.16385_none_c75225df27a90f8d\Defrag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-deployment_31bf3856ad364e35_6.1.7600.16385_none_fbc54cee4ea19794\setupugc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_6f74b7d163601da2\DevicePairingWizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-deviceproperties_31bf3856ad364e35_6.1.7600.16385_none_ea20b9269b3c9a2c\DeviceProperties.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_a69c6a8f23f521f3\diantz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_6.1.7600.16385_none_0184794e7b5db540\dvdplay.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-directshow-dvdupgrd_31bf3856ad364e35_6.1.7600.16385_none_7d9cbcec3df8da86\dvdupgrd.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-directx-directplay4_31bf3856ad364e35_6.1.7600.16385_none_76e6c1802136b090\dplaysvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7600.16385_none_78acde382012c2ac\dpnsvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-diskpart_31bf3856ad364e35_6.1.7600.16385_none_68aebb7df7407c35\diskpart.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-diskraid_31bf3856ad364e35_6.1.7600.16385_none_655ffa33f94dc714\diskraid.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-dispdiag_31bf3856ad364e35_6.1.7600.16385_none_44babf78916ac280\dispdiag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-displayswitch_31bf3856ad364e35_6.1.7600.16385_none_ec98071c85cf09eb\DisplaySwitch.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7600.16385_none_e1b8d300e3acf8dc\dnscacheugc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_7da9291f2ec46948\dpapimig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-dpiscaling_31bf3856ad364e35_6.1.7600.16385_none_7a1e2959bc43abd5\DpiScaling.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_95f92198f65d354d\driverquery.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_6.1.7600.16385_none_46fb81e75b1ad412\Dxpserver.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_6.1.7600.16385_none_d96243212694b69e\esentutl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_fe75fb7856d846d5\DWWIN.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_6.1.7600.16385_none_8a203e045f71a57b\Eap3Host.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_6.1.7600.16385_none_07c100a06d2b74c6\rekeywiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-efs-ui_31bf3856ad364e35_6.1.7600.16385_none_f64b1e25e8ea1172\efsui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.1.7600.16385_none_34003e8d3b4dc79c\McrMgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcx2prov_31bf3856ad364e35_6.1.7600.16385_none_d86387f77a6469c9\Mcx2Prov.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcxtask_31bf3856ad364e35_6.1.7600.16385_none_5a9d7f2ae4a9228f\McxTask.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehmsas_31bf3856ad364e35_6.1.7600.16385_none_2ae92a9cce326e3f\ehmsas.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehprivjob_31bf3856ad364e35_6.1.7600.16385_none_f4e986db931eeeab\ehprivjob.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehrec_31bf3856ad364e35_6.1.7600.16385_none_4ac9e738b65b791d\ehrec.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehshell_31bf3856ad364e35_6.1.7600.16385_none_3976c0515b3306e5\ehshell.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehtray_31bf3856ad364e35_6.1.7600.16385_none_2aaf63e2ce5cada5\ehtray.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-ehvid_31bf3856ad364e35_6.1.7600.16385_none_4b3f146eb60f4984\ehvid.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-mcglidhost_31bf3856ad364e35_6.1.7600.16385_none_a9841ba05f8eab34\mcGlidHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-mcspad_31bf3856ad364e35_6.1.7600.16385_none_616d9707cc8c9e84\mcspad.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-services-ehrecvr_31bf3856ad364e35_6.1.7600.16385_none_bd3fd42782f1ef9a\ehrecvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-services-ehsched_31bf3856ad364e35_6.1.7600.16385_none_a54954fd9d61ab4b\ehsched.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ehome-wtvconverter_31bf3856ad364e35_6.1.7600.16385_none_4c27af48fd4bae23\WTVConverter.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7600.16385_none_204d08396737d15a\wermgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7600.16385_none_6fdd72c59e1ce6aa\WerFault.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7600.16385_none_6fdd72c59e1ce6aa\WerFaultSecure.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-es-authentication_31bf3856ad364e35_6.1.7600.16385_none_419312c477ec702a\EhStorAuthn.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-eudcedit_31bf3856ad364e35_6.1.7600.16385_none_596edac920d1bcaa\eudcedit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_fae3f90ad6068afa\wecutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-eventcreate_31bf3856ad364e35_6.1.7600.16385_none_d53926c7a0e7716d\eventcreate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-eventlog-commandline_31bf3856ad364e35_6.1.7600.16385_none_c0aa8bc2de239cf9\wevtutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-extrac32_31bf3856ad364e35_6.1.7600.16385_none_dafff0c26538f91f\extrac32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-f..client-applications_31bf3856ad364e35_6.1.7600.16385_none_78d0028a89b9fa52\FXSCOVER.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-f..client-applications_31bf3856ad364e35_6.1.7600.16385_none_78d0028a89b9fa52\WFS.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_009cfaa696afe78b\comp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_009cfaa696afe78b\fc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7600.16385_none_acf9efe0e19d01e2\FXSSVC.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7600.16385_none_acf9efe0e19d01e2\FXSUNATD.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-fdddo_31bf3856ad364e35_6.1.7600.16385_none_54bf8f7a944a30ac\DeviceDisplayObjectProvider.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-filtermanager-utils_31bf3856ad364e35_6.1.7600.16385_none_1964092586ab4352\fltMC.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-findstr_31bf3856ad364e35_6.1.7600.16385_none_2705e185bb083cf5\findstr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-fontview_31bf3856ad364e35_6.1.7600.16385_none_443a636317ca9b75\fontview.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-forfiles_31bf3856ad364e35_6.1.7600.16385_none_54f9c5c33edc5fbb\forfiles.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-fsutil_31bf3856ad364e35_6.1.7600.16385_none_cc3a6a9c514031a2\fsutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ftp_31bf3856ad364e35_6.1.7600.16385_none_acc1b413b9dd9327\ftp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_3b3f55233d47d4f2\gpresult.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_3b3f55233d47d4f2\gpupdate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_0bd4ecde034ea7da\getmac.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-gettingstarted_31bf3856ad364e35_6.1.7600.16385_none_8053bb69558ffadc\GettingStarted.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-grouppolicy-script_31bf3856ad364e35_6.1.7600.16385_none_64ed8ea5d0ffd85e\gpscript.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-grpconv_31bf3856ad364e35_6.1.7600.16385_none_a25e7b019f016e70\grpconv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-help-client_31bf3856ad364e35_6.1.7600.16385_none_6beee6458f6a465e\HelpPane.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_c82c4cd5e6101085\hh.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_8.0.7600.16385_none_23079f05995ee912\SetIEInstalledDate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_6.1.7600.16385_none_247621f7aa7542ff\ImagingDevices.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_b346f9b4861b55c2\iexplore.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7600.16385_none_da4a0161766b85b6\iscsicli.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..lified-chinese-core_31bf3856ad364e35_6.1.7600.16385_none_17e7b404a947137b\IMSCPROP.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7600.16385_none_151dac996ae5a654\tzupd.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_6.1.7600.16385_none_595a53b0624ba27c\IMTCPROP.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-icacls_31bf3856ad364e35_6.1.7600.16385_none_328af534074dc6cc\icacls.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-icm-dccw_31bf3856ad364e35_6.1.7600.16385_none_1ac50203efd6e328\dccw.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-icm-ui_31bf3856ad364e35_6.1.7600.16385_none_3a2f0d8e0222fc0f\colorcpl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7600.16385_none_16de8c64b31791b3\msfeedssync.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7600.16385_none_42797377fc24e88d\RegisterIEPKEYs.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.7600.16385_none_73ea8c9be1b31cce\mshta.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_8.0.7600.16385_none_2106a98149904819\ielowutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_7f0c7a3c17077fce\iexpress.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_7f0c7a3c17077fce\wextract.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_8.0.7600.16385_none_488e5dfb9bdb243c\ExtExport.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.7600.16385_none_49f29d63f2540eb7\ieUnatt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7600.16385_none_e061527f36ced75c\ie4uinit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_8.0.7600.16385_none_032c767969f7eb6f\ieinstal.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7600.16385_none_d5f05b0bdb85de66\IMCCPHR.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-infdefaultinstall_31bf3856ad364e35_6.1.7600.16385_none_6c6ad9e2fd62ff6a\InfDefaultInstall.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7600.16385_none_4957caefe76d7816\msiexec.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7600.16385_none_e980baac3b1495a7\MuiUnattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ipconfig_31bf3856ad364e35_6.1.7600.16385_none_4c104723794237c2\ipconfig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-irftp_31bf3856ad364e35_6.1.7600.16385_none_5690970fdf952e2a\irftp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_6.1.7600.16385_none_d7c180d4bd657495\iscsicpl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-isoburn_31bf3856ad364e35_6.1.7600.16385_none_e608fd42fa8ed70d\isoburn.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ktmutil_31bf3856ad364e35_6.1.7600.16385_none_88604e41627c6de1\ktmutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-label_31bf3856ad364e35_6.1.7600.16385_none_570561eb2b9c151d\label.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_e24a7886a9947ebf\hdwwiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-lpksetup_31bf3856ad364e35_6.1.7600.16385_none_212fb72ccdcc0c8d\lpksetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-lpksetup_31bf3856ad364e35_6.1.7600.16385_none_212fb72ccdcc0c8d\lpremove.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.16385_none_a620e0e5be1ecda7\lsass.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-lua_31bf3856ad364e35_6.1.7600.16385_none_a620b355be1f00e9\consent.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_6.1.7600.16385_none_28bc88ef47fee095\MdRes.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_0f49a133d6f5d42b\mmc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..-mctadmin-component_31bf3856ad364e35_6.1.7600.16385_none_0b10b724fca75a88\mctadmin.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_6.1.7600.16385_none_44263d819f0aa19e\odbcad32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_6.1.7600.16385_none_6ff39cfbb8057a05\cliconfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..cationnotifications_31bf3856ad364e35_6.1.7600.16385_none_175ab6276b721d6a\LocationNotifications.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_6.1.7600.16385_none_93acf25fdb0b19ba\MdSched.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..lepc-mobilitycenter_31bf3856ad364e35_6.1.7600.16385_none_5a704afd6c96af65\mblctr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_6.1.7600.16385_none_a35e5b130757d4ea\ucsvc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\attrib.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\doskey.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\find.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\print.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\replace.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\subst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7600.16385_none_ba516d0cf5a8dbbc\MigAutoPlay.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7600.16385_none_ba516d0cf5a8dbbc\MigSetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7600.16385_none_ba516d0cf5a8dbbc\migwiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7600.16385_none_ba516d0cf5a8dbbc\PostMig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_6.1.7600.16385_none_c0742954d48af621\wmprph.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..resentationsettings_31bf3856ad364e35_6.1.7600.16385_none_6cfdb0cd64bdb2e0\PresentationSettings.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_6.1.7600.16385_none_0d4d30a05370cb73\odbcconf.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-m..yer-sideshow-gadget_31bf3856ad364e35_6.1.7600.16385_none_27fff9111045b65e\WMPSideShowGadget.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-magnify_31bf3856ad364e35_6.1.7600.16385_none_6e042d8ffa037534\Magnify.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-makecab_31bf3856ad364e35_6.1.7600.16385_none_f0a5d809ca926e4f\makecab.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mapi_31bf3856ad364e35_6.1.7600.16385_none_ab2397727b134496\fixmapi.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7600.16385_none_9c35855f6e153ff4\mfpmp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7600.16385_none_9c35855f6e153ff4\rrinstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_6.1.7600.16385_none_1ad106c1a14e554e\wmlaunch.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7600.16385_none_0b401942b06d4f06\wmpconfig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7600.16385_none_0b401942b06d4f06\wmplayer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7600.16385_none_0b401942b06d4f06\wmpshare.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_6.1.7600.16385_none_eb16e25b235c6d90\logagent.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7600.16385_none_adca1fa537de6f5e\setup_wm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7600.16385_none_adca1fa537de6f5e\unregmp2.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpenc_31bf3856ad364e35_6.1.7600.16385_none_a3fa8a7d892f3cc9\wmpenc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-migrationengine_31bf3856ad364e35_6.1.7600.16385_none_587e2dd63c939245\mighost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7600.16385_none_ef272fb1b5a8b36e\mobsync.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mountvol_31bf3856ad364e35_6.1.7600.16385_none_b22fcf90b2c6e173\mountvol.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_c718d071d9c10a2d\auditpol.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.1.7600.16385_none_da5094a6ff13a602\msconfig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-msdt_31bf3856ad364e35_6.1.7600.16385_none_a558b8167eda0eef\msdt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.1.7600.16385_none_861b553e4c3473c1\msinfo32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7600.16385_none_abb2bcfa5b01dea9\msinfo32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mspaint_31bf3856ad364e35_6.1.7600.16385_none_8df3dcc84fe54e8b\mspaint.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7600.16385_none_19e2f25f162bea59\mcbuilder.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-mystify_31bf3856ad364e35_6.1.7600.16385_none_efe7f135c0b0da6e\Mystify.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-n..protection-statusui_31bf3856ad364e35_6.1.7600.16385_none_3d715a438950ce7b\NAPSTAT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-nbtstat_31bf3856ad364e35_6.1.7600.16385_none_9de6da957fb287cb\nbtstat.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-net-command-line-tool_31bf3856ad364e35_6.1.7600.16385_none_5208a7a3d3caa54c\net.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_6.1.7600.16385_none_86b24994b5e6bfbf\net1.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.1.7600.16385_none_603b1e855897bcd6\netbtugc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-netcfg_31bf3856ad364e35_6.1.7600.16385_none_100531dbb2cd1c86\netcfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-netplwiz-exe_31bf3856ad364e35_6.1.7600.16385_none_ed2d0ae971b57e8d\Netplwiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-netsh_31bf3856ad364e35_6.1.7600.16385_none_5f774c61592c67c3\netsh.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_07c046fe67692e98\bridgeunattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-networkprojection_31bf3856ad364e35_6.1.7600.16385_none_e39dd9555210c2c2\NetProj.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24\ndadmin.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24\newdev.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-notepadwin_31bf3856ad364e35_6.1.7600.16385_none_42a023025c60a33a\notepad.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_6ef0e39ed15350e4\notepad.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-nslookup_31bf3856ad364e35_6.1.7600.16385_none_cb56ca13c7c623f6\nslookup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1.7600.16385_none_fde3cf3dd3e16d0d\csrstub.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1.7600.16385_none_fde3cf3dd3e16d0d\ntvdm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-o..calmediadisc-wizard_31bf3856ad364e35_6.1.7600.16385_none_1a620ef7a9388190\DVDMaker.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ocsetup_31bf3856ad364e35_6.1.7600.16385_none_e3538819c09b5ce4\ocsetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-oobe-machine_31bf3856ad364e35_6.1.7600.16385_none_0d54a05864853eb2\msoobe.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-openfiles_31bf3856ad364e35_6.1.7600.16385_none_e6fcbd244bb7bf74\openfiles.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-optionalfeatures_31bf3856ad364e35_6.1.7600.16385_none_663d506d4f028574\OptionalFeatures.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-optionaltsps_31bf3856ad364e35_6.1.7600.16385_none_e1d294682a365d27\tcmsetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-osk_31bf3856ad364e35_6.1.7600.16385_none_aa93298fbb4246f2\osk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7600.16385_none_d62a95c3573fe05d\printui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7600.16385_none_60f9d0f46028b3c9\diskperf.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7600.16385_none_60f9d0f46028b3c9\logman.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7600.16385_none_60f9d0f46028b3c9\relog.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7600.16385_none_60f9d0f46028b3c9\tracerpt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7600.16385_none_60f9d0f46028b3c9\typeperf.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_6.1.7600.16385_none_09320e5ae212b9d9\powercfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_6.1.7600.16385_none_9c856911bff5c373\PrintIsolationHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.1.7600.16385_none_2b83efad3cba72d8\printfilterpipelinesvc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.1.7600.16385_none_efd9d05fdebfcc15\ntprint.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.1.7600.16385_none_b3b2e4c291c5a24e\plasrv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_6.1.7600.16385_none_8aa8bbd129b6cfb3\wpnpinst.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7600.16385_none_81907e97a6a8293b\PrintBrm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7600.16385_none_81907e97a6a8293b\PrintBrmEngine.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7600.16385_none_81907e97a6a8293b\PrintBrmUi.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..tomizationsnonwinpe_31bf3856ad364e35_6.1.7600.16385_none_cba53f86f08a5755\PnPUnattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_715c537b603a5ee2\lodctr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_715c537b603a5ee2\unlodctr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-packagemanager_31bf3856ad364e35_6.1.7600.16385_none_ecae1a3f5497db18\PkgMgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_6.1.7600.16385_none_f502240760fba9c4\pcwrun.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-peertopeercollab_31bf3856ad364e35_6.1.7600.16385_none_970ba4a68e7620bd\p2phost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7600.16385_none_9be0144f02478581\perfmon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7600.16385_none_9be0144f02478581\resmon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.1.7600.16385_none_6ba4d4fbb9c994fa\PhotoScreensaver.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_a907fb2af12e5dc6\PATHPING.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_a907fb2af12e5dc6\PING.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_a907fb2af12e5dc6\TRACERT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-pnphotplugui_31bf3856ad364e35_6.1.7600.16385_none_e8b787acac120444\DeviceEject.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-pnpui_31bf3856ad364e35_6.1.7600.16385_none_5eade77d8c9d065b\dinotify.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-pnputil_31bf3856ad364e35_6.1.7600.16385_none_fd3a18b51ddb1bdf\PnPutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-powershell-exe_31bf3856ad364e35_6.1.7600.16385_none_68ec54d7638638f5\powershell.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.16385_none_d621f94522dc5a87\spoolsv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-proquota_31bf3856ad364e35_6.1.7600.16385_none_279d4dfaf3b8bd5a\proquota.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_6.1.7600.16385_none_316a8a208c030e56\reg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_5ae7f926deb5de01\rdrleakdiag.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_2fc9f616d6e642c0\raserver.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_0fb054d9c6a6b4d4\rasautou.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_6f1d25ec0a04d811\rasdial.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_6f1d25ec0a04d811\rasphone.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_5ef69594c1d92260\cmdl32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_5ef69594c1d92260\cmmon32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7600.16385_none_5ef69594c1d92260\cmstp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7600.16385_none_8452509514f4db22\recdisc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-recover_31bf3856ad364e35_6.1.7600.16385_none_85e9a3f215ee94e3\recover.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-regini_31bf3856ad364e35_6.1.7600.16385_none_0c2c92921b2478ef\regini.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedt32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-regsvr32_31bf3856ad364e35_6.1.7600.16385_none_782d737490d72da3\regsvr32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-reliability-postboot_31bf3856ad364e35_6.1.7600.16385_none_4d97265566a66f7e\RelPost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_372e6d4f633963b8\msra.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_372e6d4f633963b8\sdchange.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-restartmanager_31bf3856ad364e35_6.1.7600.16385_none_800bbdee85723191\RmClient.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-ribbons_31bf3856ad364e35_6.1.7600.16385_none_888b3a25894f80b8\Ribbons.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-robocopy_31bf3856ad364e35_6.1.7600.16385_none_c6dd85a44db7d22a\Robocopy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rpc-locator_31bf3856ad364e35_6.1.7600.16385_none_cf0ae9504deb8ab1\Locator.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rpc-ping_31bf3856ad364e35_6.1.7600.16385_none_9d906433a20c1949\RpcPing.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-runas_31bf3856ad364e35_6.1.7600.16385_none_5fbe9f67bec0f818\runas.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-rundll32_31bf3856ad364e35_6.1.7600.16385_none_d7dba7b30c3e2855\rundll32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_6.1.7600.16385_none_10e2654156a06b06\RunLegacyCPLElevated.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-runonce_31bf3856ad364e35_6.1.7600.16385_none_15912ac0205b8771\runonce.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_6.1.7600.16385_none_f4ed25ac5fc275b6\RMActivate_ssp_isv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..boxgames-backgammon_31bf3856ad364e35_6.1.7600.16385_none_0a6e67948d2aa502\bckgzm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_6.1.7600.16385_none_de06b4fbd5b45f78\BitLockerToGo.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_6.1.7600.16385_none_19fc3ad2bde50aa3\sdiagnhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..erinboxgames-spades_31bf3856ad364e35_6.1.7600.16385_none_13883bb2626e33de\shvlzm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..estartup-fverecover_31bf3856ad364e35_6.1.7600.16385_none_4ee6b739366ce92b\BdeUnlockWizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_c9b9bfc685ed05d3\SystemPropertiesDataExecutionPrevention.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..inboxgames-checkers_31bf3856ad364e35_6.1.7600.16385_none_761811ed16821654\chkrzm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_58481bbdfe2e6164\FreeCell.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..inboxgames-shanghai_31bf3856ad364e35_6.1.7600.16385_none_c07a51d9507d9398\Mahjong.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..iuminboxgames-chess_31bf3856ad364e35_6.1.7600.16385_none_74aaf7f0dfbacf9f\Chess.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_f3e05452c52c6325\Hearts.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..line-user-interface_31bf3856ad364e35_6.1.7600.16385_none_dcbdc8e83e2b98be\cmdkey.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_6.1.7600.16385_none_7444913c36004801\sc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.1.7600.16385_none_828e8a89d6a2ba3d\SpiderSolitaire.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_6.1.7600.16385_none_f71eddfb459a0155\SystemPropertiesAdvanced.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_40d0db63344deff9\SystemPropertiesHardware.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_6.1.7600.16385_none_e928342250fd4b9c\RMActivate_isv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_74f3b07c5d008bde\Solitaire.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_6.1.7600.16385_none_5aad0353642dd29f\SystemPropertiesPerformance.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7600.16385_none_6f9515b1c56564fb\RMActivate_ssp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..otservicing-utility_31bf3856ad364e35_6.1.7600.16385_none_751b074aed0a5d09\fveupdate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_a237737f9a82de12\MineSweeper.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_0601d49e5fc57a03\PurblePlace.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_6.1.7600.16385_none_304988749d91936f\SystemPropertiesComputerName.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_36251cb0347ba7a9\baaupdate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_6.1.7600.16385_none_d1ca977b7158d8f6\repair-bde.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_6.1.7600.16385_none_6388acf17dd74912\SystemPropertiesProtection.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_6.1.7600.16385_none_a0cbc58692cbb35b\RMActivate.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_6.1.7600.16385_none_a0c7dd7eca510f1b\BdeHdCfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-safedocs-main_31bf3856ad364e35_6.1.7600.16385_none_24e0126fc81c293d\sdclt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_483ea93961ad86ec\cscript.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_483ea93961ad86ec\wscript.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-scrnsave_31bf3856ad364e35_6.1.7600.16385_none_e115f7273bb86d58\scrnsave.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sctasks_31bf3856ad364e35_6.1.7600.16385_none_8a15cdb716a9eff1\schtasks.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-secinit_31bf3856ad364e35_6.1.7600.16385_none_878e469b2e51ce80\secinit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7600.16385_none_575cad77ec6bf51f\BitLockerWizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7600.16385_none_575cad77ec6bf51f\BitLockerWizardElev.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-securestartup-notify_31bf3856ad364e35_6.1.7600.16385_none_1cc8c1810953573d\fvenotify.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-securestartup-prompt_31bf3856ad364e35_6.1.7600.16385_none_efe5c3454547bbfe\fveprompt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-securestartup-service_31bf3856ad364e35_6.1.7600.16385_none_647c0a30066b1ab5\BdeUISrv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_6.1.7600.16385_none_f9f113db18a9e7d9\manage-bde.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_aebd843e13122315\SecEdit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7600.16385_none_5b97f4df0025c6e9\slui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-spp_31bf3856ad364e35_6.1.7600.16385_none_1a37ad9b82468857\sppsvc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-syskey_31bf3856ad364e35_6.1.7600.16385_none_1838ef0586d5af46\syskey.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-tools-klist_31bf3856ad364e35_6.1.7600.16385_none_410af5d427df6ed9\klist.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_6.1.7600.16385_none_1c431cb1af7bf5b0\ksetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-tools-nltest_31bf3856ad364e35_6.1.7600.16385_none_9a357bb05dac59be\nltest.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-tools-setspn_31bf3856ad364e35_6.1.7600.16385_none_7fdbf78d3f7767ef\setspn.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-vault_31bf3856ad364e35_6.1.7600.16385_none_f13f66da9c5ca4c2\VaultCmd.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-security-vault_31bf3856ad364e35_6.1.7600.16385_none_f13f66da9c5ca4c2\VaultSysUi.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-servicepackcoordinator_31bf3856ad364e35_6.1.7600.16385_none_3497783888e4894b\spinstall.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-session0viewer_31bf3856ad364e35_6.1.7600.16385_none_e1bd3e25a80193e3\UI0Detect.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sethc_31bf3856ad364e35_6.1.7600.16385_none_6296951cd66ee3c2\sethc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7600.16385_none_3202d4720e95de08\audit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7600.16385_none_3202d4720e95de08\oobeldr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7600.16385_none_3202d4720e95de08\Setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7600.16385_none_3202d4720e95de08\setupsqm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7600.16385_none_3202d4720e95de08\windeploy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-setupcl_31bf3856ad364e35_6.1.7600.16385_none_58855bf74c9b8345\setupcl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-setx_31bf3856ad364e35_6.1.7600.16385_none_ac4d2bf27a63f85f\setx.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_04a3b4c9aa9fddd8\icsunattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\shrpubw.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7600.16385_none_4313bb4662323b50\prevhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_02aa6dd4294b8d5f\shutdown.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7600.16385_none_ceb301e087fbb047\sbunattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7600.16385_none_ceb301e087fbb047\sidebar.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sigverif_31bf3856ad364e35_6.1.7600.16385_none_bb6fda805cb2381c\sigverif.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_ac10fe207a85352b\smss.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-snippingtool-app_31bf3856ad364e35_6.1.7600.16385_none_999a5852eaf68953\SnippingTool.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-snmp-trap-service_31bf3856ad364e35_6.1.7600.16385_none_cf615500a0bb6ff9\snmptrap.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.1.7600.16385_none_1ce85d64ba8de34d\SBEServer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sort_31bf3856ad364e35_6.1.7600.16385_none_ab9479767ad67fd7\sort.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-soundrecorder_31bf3856ad364e35_6.1.7600.16385_none_9edf9bc69436ef30\SoundRecorder.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7600.16385_none_1be0462ead20352d\SpeechUXTutorial.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7600.16385_none_1be0462ead20352d\SpeechUXWiz.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_6.1.7600.16385_none_027fdd2324e3c2dd\sapisvr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_6.1.7600.16385_none_d415c20cc2eaaf30\wsqmcons.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-srdelayed_31bf3856ad364e35_6.1.7600.16385_none_5633adf6bd7b303e\srdelayed.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sstext3d_31bf3856ad364e35_6.1.7600.16385_none_040f0ea1c0efc953\ssText3d.scr	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-stickynotes-app_31bf3856ad364e35_6.1.7600.16385_none_ed1d0d211a9f2561\StikyNot.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sxs_31bf3856ad364e35_6.1.7600.16385_none_ae22f23fb8f750ab\sxstrace.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_6957633c5de5fc54\SyncHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sysinfo_31bf3856ad364e35_6.1.7600.16385_none_ef2b073e59e262f6\systeminfo.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-sysprep_31bf3856ad364e35_6.1.7600.16385_none_ef54f6e859ce76cf\sysprep.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\SystemPropertiesRemote.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.1.7600.16385_none_46b6260b1492939a\rstrui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-systray_31bf3856ad364e35_6.1.7600.16385_none_f327d2f6575da8ce\systray.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_6.1.7600.16385_none_ed6e97c85c464885\hwrcomp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_6.1.7600.16385_none_ed6e97c85c464885\hwrreg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_6.1.7600.16385_none_41c821eeeae8dea2\pipanel.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_6.1.7600.16385_none_314e00fcb9a31524\TSWbPrxy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7600.16385_none_423b458dae59129d\PDIALOG.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_28ffc7850d58b3f3\msg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_28ffc7850d58b3f3\quser.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_28ffc7850d58b3f3\qwinsta.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\change.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\chglogon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\chgport.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\chgusr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\logoff.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\qappsrv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\qprocess.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\query.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\reset.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\rwinsta.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\shadow.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\tscon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\tsdiscon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7600.16385_none_e486af895a57d1b2\tskill.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_6.1.7600.16385_none_263b90e03e95cee1\wksprt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_6.1.7600.16385_none_ca77d93bb23f06e1\mip.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_6.1.7600.16385_none_0d580453d317a99d\FlickLearningWizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_6.1.7600.16385_none_1eb1767ca777285a\rdpinit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_6.1.7600.16385_none_1eb1767ca777285a\rdpshell.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_6.1.7600.16385_none_01ac66c66c75c026\rdpclip.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_6.1.7600.16385_none_350eaebbf4dcb530\rdpsign.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7600.16385_none_a51b22e46bde44fe\lsm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_6.1.7600.16385_none_4db2a3b8826b256f\mstsc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_3f82691927a7cab9\ConvertInkStore.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_3f82691927a7cab9\InputPersonalization.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_3f82691927a7cab9\ShapeCollector.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-t..platform-input-core_31bf3856ad364e35_6.1.7600.16385_none_d0e6a29c3e217b6f\wisptis.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_6.1.7600.16385_none_df49c84bbc44d8f4\MultiDigiMon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_6.1.7600.16385_none_df49c84bbc44d8f4\tabcal.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tabletpc-inkwatson_31bf3856ad364e35_6.1.7600.16385_none_082d7f15624f2ec5\InkWatson.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_6.1.7600.16385_none_11656be9d8d5e28f\TabTip.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7600.16385_none_1787de7505ebcb56\Journal.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-takeown_31bf3856ad364e35_6.1.7600.16385_none_f9c1bbed76f1af6c\takeown.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_e4102eada7ea2fc8\dialer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tapisetup_31bf3856ad364e35_6.1.7600.16385_none_69c980e6fc7d9b52\TapiUnattend.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7600.16385_none_2814fe7cbba96e6a\taskhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-taskkill_31bf3856ad364e35_6.1.7600.16385_none_25545528bd642170\taskkill.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tasklist_31bf3856ad364e35_6.1.7600.16385_none_28198854bba53a00\tasklist.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-taskmgr_31bf3856ad364e35_6.1.7600.16385_none_143885510a878638\taskmgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7600.16385_none_e582a352202e02c8\taskeng.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7600.16385_none_329d49cdb031b824\ARP.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7600.16385_none_329d49cdb031b824\finger.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7600.16385_none_329d49cdb031b824\HOSTNAME.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7600.16385_none_329d49cdb031b824\MRINFO.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7600.16385_none_329d49cdb031b824\NETSTAT.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7600.16385_none_329d49cdb031b824\ROUTE.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7600.16385_none_329d49cdb031b824\TCPSVCS.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7600.16385_none_615bebfff0ad4029\netiougc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-terminalservices-theme_31bf3856ad364e35_6.1.7600.16385_none_d5bc65ffdc22ec35\TSTheme.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-timeout_31bf3856ad364e35_6.1.7600.16385_none_8c3ac2e4279846be\timeout.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_6.1.7600.16385_none_77536d124094b997\TpmInit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-trustedinstaller_31bf3856ad364e35_6.1.7600.16385_none_90e389a7ae7a4b6c\TrustedInstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-tzutil_31bf3856ad364e35_6.1.7600.16385_none_341a2afc647aa5b9\tzutil.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_6.1.7600.16385_none_837b680f39ef1eeb\UserAccountControlSettings.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-unattendedjoin_31bf3856ad364e35_6.1.7600.16385_none_b2eb3ac2ce28339d\djoin.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_c1be8a9895d79340\upnpcont.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-utilman_31bf3856ad364e35_6.1.7600.16385_none_028006129290e443\Utilman.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-w..etwork-setup-wizard_31bf3856ad364e35_6.1.7600.16385_none_94b38187a5bad85e\setupSNK.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7600.16385_none_ca3bcb830e5b61c6\WSManHTTPConfig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7600.16385_none_ca3bcb830e5b61c6\wsmprovhost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7600.16385_none_89088a6bbd843b3f\twunk_32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.3.7600.16385_none_c0a2c4678ce1f4b2\wuapp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7600.16385_none_cecad578e69f2b85\wiaacmgr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.3.7600.16385_none_3086c9dad36a69b3\wuauclt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_6.1.7600.16385_none_7b6b4dfc18ad8e6b\WinSAT.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7600.16385_none_427fb3a438e633d3\wab.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7600.16385_none_427fb3a438e633d3\wabmig.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_5da98f433f7e2878\where.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-whoami_31bf3856ad364e35_6.1.7600.16385_none_ce52d479e329be32\whoami.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wimgapi_31bf3856ad364e35_6.1.7600.16385_none_88d1f88d76321f27\wimserv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-winhstb_31bf3856ad364e35_6.1.7600.16385_none_28dc647c6aba6742\winhlp32.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_9449cff8ee4f6cca\mpnotify.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_9449cff8ee4f6cca\wlrmdr.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-winre-recoverytools_31bf3856ad364e35_6.1.7600.16385_none_d5242a97d27cdfd9\ReAgentc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrs.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrshost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_b627d45ffdcc6f00\winver.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wlan-extension_31bf3856ad364e35_6.1.7600.16385_none_f9b9855184ad1e6d\wlanext.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_6.1.7600.16385_none_ee39c6ec58b46e4f\WMPDMC.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7600.16385_none_035d21f62fe736df\wmpnetwk.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wmpnss-ux_31bf3856ad364e35_6.1.7600.16385_none_b79b19341aca35eb\wmpnscfg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wordpad_31bf3856ad364e35_6.1.7600.16385_none_2d90cf56ce391a32\wordpad.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wpd-shellextension_31bf3856ad364e35_6.1.7600.16385_none_10ff42ce281d47d6\WPDShextAutoplay.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-writewin_31bf3856ad364e35_6.1.7600.16385_none_db699b3f5190c6d8\write.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_5f5928533e6b72c0\write.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_6.1.7600.16385_none_2b1523604c99c736\sfc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-wusa_31bf3856ad364e35_6.1.7600.16385_none_acd6e7a079f0709d\wusa.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7600.16385_none_f36d0d15effa7588\CertEnrollCtrl.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-xcopy_31bf3856ad364e35_6.1.7600.16385_none_62cc00cc559fd4ec\xcopy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-xpsreachviewer_31bf3856ad364e35_6.1.7600.16385_none_14f1a9a3af8b16ff\xpsrchvw.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_microsoft-windows-xwizard-host-process_31bf3856ad364e35_6.1.7600.16385_none_58ca66f699d77ff1\xwizard.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_99be0d55273fde9a\AppLaunch.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_e6af0acbde467b7b\aspnet_regiis.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_55a43aca7f285819\aspnet_state.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_99702545489547b3\aspnet_wp.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_d797745a4a1a7c82\ilasm.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_d2fff1dae966863c\csc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7600.16385_none_ba476986f05abc65\cvtres.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_a223bd3dd785391a\dw20.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_f47d7472a4c4e67e\mscorsvw.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_6.1.7600.16385_none_3b6545980f480049\NETFXSBS10.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_4c4430e106efd828\ngen.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx-vb_compiler_b03f5f7f11d50a3a_6.1.7600.16385_none_14765e50628d5d65\vbc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_58326e688d4907c6\WFServicesReg.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx35linq-csharp_31bf3856ad364e35_6.1.7600.16385_none_1702052d757d6e3d\csc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_6.1.7600.16385_none_95d8aaba50b43dd9\vbc.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_579306edb982ae36\MpCmdRun.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_579306edb982ae36\MSASCui.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_wcf-icardagt_exe_31bf3856ad364e35_6.1.7600.16385_none_31ae00ebd2fb34b5\icardagt.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_6.1.7600.16385_none_fff7b2337e797fdc\SMConfigInstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.7600.16385_none_733078db7cc905a7\SearchFilterHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.7600.16385_none_733078db7cc905a7\SearchIndexer.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.7600.16385_none_733078db7cc905a7\SearchProtocolHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old\Windows\winsxs\x86_wpf-presentationhostexe_31bf3856ad364e35_6.1.7600.16385_none_6fca8974817173aa\PresentationHost.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Documents and Settings\Hendri\AppData\Local\Application Data\Temp\_iu14D2N.tmp	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\DW\DW20.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\DW\DWTRIG20.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Win32/Sality.NBA virus	cleaned - quarantined
C:\Windows.old.000\Program Files\Microsoft Office\Office14\BCSSync.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\autorun.inf	INF/Autorun.gen worm	cleaned by deleting (after the next restart) - quarantined
D:\rcjy.exe	Win32/Sality.NBA virus	cleaned by deleting - quarantined
D:\AetherFlyff - Basilisk\CrashSender1400.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\AetherFlyff - Basilisk\Launcher.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\AetherFlyff - Basilisk\Neuz.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\AetherFlyff - Basilisk\unins000.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\AetherFlyff - Basilisk\XorUpdater.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Alpine Escape.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Among the Clouds.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Anjing & Kucing.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Ball Punch.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Balloons.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Bersih Kamar.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Bowling.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Cari Beda.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Cowboy.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Disco.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\EGGS.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\EverythingisUnexpectable.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\FRIEND.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Helicopter.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Iwak Hiu.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Iwak Koki.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Judi Batu.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Koleksi Kentut .exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Kucing.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Mancik.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\MILLIO~1.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Nyebrang bae.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Pencak Silat.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Ping-pong.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Pinguin.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Puzzle Badut.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Puzzle.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Sky Es.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Sleep Walk.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Sniper.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\snowfight.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Suntik Boyok.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Swordman.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Telok Ayam.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Test IQ.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Thief.EXE	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Tweety.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Use Your Mind.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\WhipTheWorker.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Flash\Winnie the Pooh.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Plants vs. Zombies\PlantsVsZombies.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\All game\Plants vs. Zombies\PopUninstall.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\Biologi\Bu Ana\PENCEMARAN\autorun.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\Biologi\Bu Ana\PENCEMARAN\pencemaran.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\Teddy\Insaniquarium Deluxe\GameInstaller.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\Teddy\Insaniquarium Deluxe\Insaniquarium.scr	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\audacity-win-unicode-1.3.13.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\AutoGordianKnot.2.55.Setup_2.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\ChromeSetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\Convert-Powerpoint-to-Video-Lite-3.5Free-download.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\EM_PowerPoint_Video_Converter_setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\freevideocutter_setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\IE9-Windows7-x86-enu.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\install_flash_player.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\leawo_ppt2video_free.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\mp3cutter.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\msgr10us.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\msgr11us.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\speedyfox.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\VideoCutterSetup.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\winamp561_full_emusic-7plus_all.exe	Win32/OpenCandy application	cleaned - quarantined
D:\Dokumen Hendri\X.3\Program\wlsetup-web.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\KeyGen Ulead 11\Crack - Ulead VideoStudio 11 Plus.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\Accounting18\drvwd32.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\Accounting18\drvxl32.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\Accounting18\Myob.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\Accounting18\MyobPOpt.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\Accounting18\MYOBUpg.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\Accounting18\TemplatesUpgrader.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\Accounting18\ODBCDirect8\setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\Accounting18\OutlookSync\MYOBConnection.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\Accounting18\OutlookSync\OutlookSync.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\myob12\drvwd32.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\myob12\drvwp32.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\myob12\drvxl32.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\myob12\MyobOpt.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\myob12\MYOBUPG.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\myob12\TemplatesUpgrader.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\myob12\BASlink\BASlink.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\myob12\BASlink\BASup.exe	Win32/Sality.NBA virus	cleaned - quarantined
D:\Novita\myob12\ODBCDirect2\Setup.exe	Win32/Sality.NBA virus	cleaned - quarantined
Operating memory	multiple threats

ComboFix 12-12-02.01 - Hendri 12/04/2012 7:05.4.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1014.464 [GMT -8:00]
Running from: c:\users\Hendri\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\nsil.pif
c:\windows\ujnqdb.log
.
.
((((((((((((((((((((((((( Files Created from 2012-11-04 to 2012-12-04 )))))))))))))))))))))))))))))))
.
.
2012-12-04 15:11 . 2012-12-04 15:11	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-12-04 15:03 . 2012-12-04 15:03	29904	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D3EE01A3-89D2-4578-B43D-B313C32EDAE3}\MpKslf9363d96.sys
2012-12-04 14:53 . 2012-11-19 09:04	6812136	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D3EE01A3-89D2-4578-B43D-B313C32EDAE3}\mpengine.dll
2012-12-04 14:04 . 2012-12-04 14:04	--------	d-----w-	c:\program files\Microsoft Security Client
2012-12-04 14:03 . 2010-04-09 07:24	1285000	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-12-04 14:03 . 2010-04-09 07:24	240008	----a-w-	c:\windows\system32\drivers\netio.sys
2012-12-04 04:25 . 2012-12-04 04:25	--------	d-----w-	c:\program files\ESET
2012-12-03 08:21 . 2012-12-04 12:14	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-12-03 08:21 . 2012-09-30 03:54	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-12-03 04:18 . 2012-12-03 04:18	--------	d-----w-	c:\programdata\Malwarebytes
2012-12-03 01:04 . 2012-12-03 01:04	--------	d-----w-	c:\program files\Trend Micro
2012-12-02 18:27 . 2012-11-19 09:04	6812136	------w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C0C319C0-81A0-42E5-89F4-E523084A41B3}\mpengine.dll
2012-12-02 18:27 . 2012-01-31 12:59	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-12-02 17:23 . 2012-12-02 17:24	--------	d-----r-	c:\program files\Skype
2012-12-02 17:23 . 2012-12-02 17:23	--------	d-----w-	c:\program files\Common Files\Skype
2012-12-02 17:22 . 2012-12-02 17:56	--------	d-----w-	c:\programdata\Skype
2012-12-02 17:16 . 2009-11-25 19:47	49472	----a-w-	c:\windows\system32\netfxperf.dll
2012-12-02 17:16 . 2009-11-25 19:47	297808	----a-w-	c:\windows\system32\mscoree.dll
2012-12-02 17:16 . 2009-11-25 19:47	99176	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2012-12-02 17:16 . 2009-11-25 19:47	295264	----a-w-	c:\windows\system32\PresentationHost.exe
2012-12-02 17:16 . 2009-11-25 19:47	1130824	----a-w-	c:\windows\system32\dfshim.dll
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft Synchronization Services
2012-12-02 17:05 . 2012-12-02 18:04	--------	d-----w-	c:\program files\Microsoft.NET
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\windows\PCHEALTH
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft Sync Framework
2012-12-02 17:05 . 2012-12-02 17:05	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition
2012-12-02 17:04 . 2012-12-02 17:04	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2012-12-02 16:58 . 2012-12-02 16:58	--------	d-----w-	c:\program files\Microsoft Analysis Services
2012-12-02 16:56 . 2012-12-02 17:09	--------	d-----w-	c:\programdata\Microsoft Help
2012-12-02 16:56 . 2012-12-04 14:04	--------	d-sh--w-	c:\windows\Installer
2012-12-02 16:50 . 2009-07-28 17:41	104704	----a-w-	c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys
2012-12-02 16:49 . 2012-12-04 12:17	--------	d-----w-	c:\program files\Modem AC2726 UI
2012-12-02 16:48 . 2011-03-02 10:43	175616	----a-w-	c:\windows\system32\unrar.dll
2012-12-02 16:48 . 2008-09-24 18:41	839680	----a-w-	c:\windows\system32\lameACM.acm
2012-12-02 16:48 . 2011-07-22 08:00	74752	----a-w-	c:\windows\system32\ff_vfw.dll
2012-12-02 16:48 . 2011-07-16 14:17	151552	----a-w-	c:\windows\system32\ac3acm.acm
2012-12-02 16:48 . 2011-06-24 14:44	243200	----a-w-	c:\windows\system32\xvidvfw.dll
2012-12-02 16:48 . 2011-06-24 14:28	650752	----a-w-	c:\windows\system32\xvidcore.dll
2012-12-02 16:48 . 2010-11-03 18:08	237568	----a-w-	c:\windows\system32\yv12vfw.dll
2012-12-02 16:48 . 2012-12-04 12:13	--------	d-----w-	c:\program files\K-Lite Codec Pack
2012-12-02 16:46 . 2012-12-02 16:46	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-02 16:46 . 2012-12-02 16:46	--------	d-----w-	c:\windows\system32\Macromed
2012-12-02 16:39 . 2012-12-04 15:07	--------	d-----w-	c:\windows\system32\wbem\Performance
2012-12-02 16:36 . 2012-12-02 16:37	--------	d-----w-	c:\users\Hendri
2012-12-02 16:19 . 2012-12-02 16:36	--------	d-----w-	c:\windows\Panther
2012-12-02 01:28 . 2012-12-02 04:41	--------	d-----w-	C:\0b7846108bb474693002544a
2012-12-02 00:05 . 2012-12-02 04:54	--------	d-----r-	C:\MSOCache
2012-12-01 23:59 . 2012-12-02 16:35	--------	d-----w-	C:\Recovery
2012-12-01 23:40 . 2012-12-01 23:40	--------	d-----w-	C:\Windows.old
2012-12-01 23:39 . 2012-12-02 16:19	--------	d-----w-	C:\Boot
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-10-20 17878192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-01-22 91520]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 947176]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSLF9363D96
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1812936006-1292451050-3836158646-1000Core.job
- c:\users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02 18:39]
.
2012-12-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1812936006-1292451050-3836158646-1000UA.job
- c:\users\Hendri\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-02 18:39]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-12-04 07:14:44
ComboFix-quarantined-files.txt 2012-12-04 15:14
ComboFix2.txt 2012-12-03 08:07
ComboFix3.txt 2012-12-03 07:07
ComboFix4.txt 2012-12-03 02:23
.
Pre-Run: 27,643,723,776 bytes free
Post-Run: 27,482,914,816 bytes free
.
- - End Of File - - EB2E14F68A5F57206E52C9BAE53DA9BC


----------



## kevinf80 (Mar 21, 2006)

I asked you earlier in the thread if you re-installed the operating system. This folder appears in the logs *C:\Windows.old*
That is indicative of a re-install, that folder contains a backup from the previous OS, If you did a re-install after a previous serious infection obviously that infection was carried over. 
If you look at the ESET log you can see exactly what i`m referring to... What is the status of your system now, do you have any remaining issues or concerns...


----------



## hendri1995 (Dec 2, 2012)

Oh I see
I dont have any issues right now, thanks for your help
Do I have to delete the* C:\Windows.old* to prevent it (the issue) happen again?


----------



## kevinf80 (Mar 21, 2006)

Yes the best way forward is to delete that folder, Windows.old. When that is complete re-run DDS and post a fesh set of log, if those are clean i`ll give instructions for removal of tools we`ve used etc...

Thanks,

Kevin


----------



## hendri1995 (Dec 2, 2012)

This is the log

DDS (Ver_2012-11-20.01) - NTFS_x86 
Internet Explorer: 8.0.7600.16385
Run by Hendri at 17:00:11 on 2012-12-04
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1014.227 [GMT 7:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files\Modem AC2726 UI\bin\MonServiceUDisk.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\system32\SearchIndexer.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Modem AC2726 UI\bin\App.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Hendri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office14\GROOVEEX.DLL
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
TCP: Interfaces\{92468551-980F-49B8-896C-A17D08C8F264} : NameServer = 10.17.3.245 10.17.125.229
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office14\GROOVEEX.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-8-31 193552]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2012-11-23 3290304]
R2 UDisk Monitor;UDisk Monitor;c:\program files\modem ac2726 ui\bin\MonServiceUDisk.exe [2012-12-2 266240]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504]
R3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [2012-12-2 104704]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-19 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-10-20 164528]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2012-8-31 99272]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2012-9-13 287824]
.
=============== Created Last 30 ================
.
2012-12-04 15:23:06	99328	--sh--r-	C:\oqls.exe
2012-12-04 15:19:44	2422272	----a-w-	c:\windows\system32\wucltux.dll
2012-12-04 15:19:14	88576	----a-w-	c:\windows\system32\wudriver.dll
2012-12-04 15:18:49	33792	----a-w-	c:\windows\system32\wuapp.exe
2012-12-04 15:18:49	171904	----a-w-	c:\windows\system32\wuwebv.dll
2012-12-04 15:14:54	--------	d-sh--w-	C:\$RECYCLE.BIN
2012-12-04 15:14:49	--------	d-----w-	c:\users\hendri\appdata\local\temp
2012-12-04 14:04:01	--------	d-----w-	c:\program files\Microsoft Security Client
2012-12-04 14:03:45	240008	----a-w-	c:\windows\system32\drivers\netio.sys
2012-12-04 14:03:45	1285000	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-12-04 04:32:09	6812136	----a-w-	c:\programdata\microsoft\microsoft antimalware\definition updates\{c291196d-821b-4ae0-b301-708f6e10d693}\mpengine.dll
2012-12-04 04:25:09	--------	d-----w-	c:\program files\ESET
2012-12-03 08:22:20	--------	d-----w-	c:\users\hendri\appdata\roaming\Malwarebytes
2012-12-03 08:21:41	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-12-03 08:21:41	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-12-03 04:18:10	--------	d-----w-	c:\programdata\Malwarebytes
2012-12-03 02:12:37	98816	----a-w-	c:\windows\sed.exe
2012-12-03 02:12:37	256000	----a-w-	c:\windows\PEV.exe
2012-12-03 02:12:37	208896	----a-w-	c:\windows\MBR.exe
2012-12-03 01:04:15	388608	----a-r-	c:\users\hendri\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2012-12-03 01:04:15	--------	d-----w-	c:\program files\Trend Micro
2012-12-02 18:27:57	6812136	------w-	c:\programdata\microsoft\windows defender\definition updates\{c0c319c0-81a0-42e5-89f4-e523084a41b3}\mpengine.dll
2012-12-02 18:27:55	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-12-02 17:23:04	--------	d-----r-	c:\program files\Skype
2012-12-02 17:20:45	--------	d-----w-	c:\users\hendri\appdata\local\Programs
2012-12-02 17:16:12	99176	----a-w-	c:\windows\system32\PresentationHostProxy.dll
2012-12-02 17:16:12	49472	----a-w-	c:\windows\system32\netfxperf.dll
2012-12-02 17:16:12	297808	----a-w-	c:\windows\system32\mscoree.dll
2012-12-02 17:16:12	295264	----a-w-	c:\windows\system32\PresentationHost.exe
2012-12-02 17:16:11	1130824	----a-w-	c:\windows\system32\dfshim.dll
2012-12-02 17:10:46	--------	d-----w-	c:\users\hendri\appdata\roaming\ZTEMTUI
2012-12-02 17:05:38	--------	d-----w-	c:\program files\Microsoft Synchronization Services
2012-12-02 17:05:09	--------	d-----w-	c:\windows\PCHEALTH
2012-12-02 17:05:09	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition
2012-12-02 17:04:03	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2012-12-02 16:58:19	--------	d-----w-	c:\program files\Microsoft Analysis Services
2012-12-02 16:56:31	--------	d-----w-	c:\users\hendri\appdata\local\Microsoft Help
2012-12-02 16:56:12	--------	d-sh--w-	c:\windows\Installer
2012-12-02 16:50:02	104704	----a-w-	c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys
2012-12-02 16:49:59	--------	d-----w-	c:\program files\Modem AC2726 UI
2012-12-02 16:48:11	175616	----a-w-	c:\windows\system32\unrar.dll
2012-12-02 16:48:10	839680	----a-w-	c:\windows\system32\lameACM.acm
2012-12-02 16:48:09	74752	----a-w-	c:\windows\system32\ff_vfw.dll
2012-12-02 16:48:09	650752	----a-w-	c:\windows\system32\xvidcore.dll
2012-12-02 16:48:09	243200	----a-w-	c:\windows\system32\xvidvfw.dll
2012-12-02 16:48:09	237568	----a-w-	c:\windows\system32\yv12vfw.dll
2012-12-02 16:48:09	151552	----a-w-	c:\windows\system32\ac3acm.acm
2012-12-02 16:48:07	--------	d-----w-	c:\program files\K-Lite Codec Pack
2012-12-02 16:46:21	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-02 16:43:25	--------	d-----w-	c:\users\hendri\appdata\local\Google
2012-12-02 16:39:16	--------	d-----w-	c:\windows\system32\wbem\Performance
2012-12-02 16:19:55	--------	d-----w-	c:\windows\Panther
2012-12-02 01:28:45	-------- d-----w-	C:\0b7846108bb474693002544a
2012-12-01 23:59:48	--------	d-----w-	C:\Recovery
2012-12-01 23:39:36	--------	d-----w-	C:\Boot
.
==================== Find3M ====================
.
.
============= FINISH: 17:00:51.65 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Ultimate 
Boot Device: \Device\HarddiskVolume2
Install Date: 12/2/2012 11:36:48 PM
System Uptime: 12/4/2012 4:40:37 PM (1 hours ago)
.
Motherboard: Acer | | Volvi 
Processor: Intel(R) Core(TM) Duo CPU T2450 @ 2.00GHz | U2E1 | 800/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 51 GiB total, 32.183 GiB free.
D: is FIXED (NTFS) - 51 GiB total, 31.253 GiB free.
E: is CDROM ()
F: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: 
Description: Mass Storage Controller
Device ID: PCI\VEN_1217&DEV_7130&SUBSYS_012F1025&REV_01\4&34FE2E10&0&33F0
Manufacturer: 
Name: Mass Storage Controller
PNP Device ID: PCI\VEN_1217&DEV_7130&SUBSYS_012F1025&REV_01\4&34FE2E10&0&33F0
Service: 
.
==== System Restore Points ===================
.
RP6: 12/4/2012 9:03:16 PM - Windows Update
RP7: 12/4/2012 10:18:23 PM - Windows Update
.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
AetherFlyff - Basilisk version 1.0.0.4
ESET Online Scanner v3
Google Chrome
HiJackThis
K-Lite Codec Pack 7.5.0 (Full)
Malwarebytes Anti-Malware version 1.65.1.1000
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Security Client
Microsoft Security Essentials
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Modem AC2726 UI
Skype Click to Call
Skype™ 6.0
.
==== Event Viewer Messages From Past Week ========
.
12/4/2012 9:58:59 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.141.1009.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9002.0 Error code: 0x80240022 Error description: The program can't check for definition updates. 
12/4/2012 9:58:59 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.141.1009.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9002.0 Error code: 0x80240022 Error description: The program can't check for definition updates. 
12/4/2012 9:55:05 PM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: Hendri-PC\Hendri Error Code: 0x8007042c Error description: The dependency service or group failed to start. 
12/4/2012 9:55:05 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: Hendri-PC\Hendri Current Engine Version: Previous Engine Version: Error code: 0x8007042c Error description: The dependency service or group failed to start. 
12/4/2012 10:11:39 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
12/4/2012 10:09:54 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
12/4/2012 10:09:53 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
12/4/2012 10:09:53 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
12/4/2012 10:09:51 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
12/4/2012 10:09:51 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
12/4/2012 10:09:50 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/4/2012 10:09:45 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
12/4/2012 10:09:41 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
12/4/2012 10:09:41 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
12/4/2012 10:04:55 PM, Error: Service Control Manager [7034] - The UDisk Monitor service terminated unexpectedly. It has done this 1 time(s).
12/4/2012 10:03:08 PM, Error: Service Control Manager [7034] - The Skype C2C Service service terminated unexpectedly. It has done this 1 time(s).
12/3/2012 7:30:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
12/3/2012 7:29:17 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
12/3/2012 4:46:37 PM, Error: Service Control Manager [7023] - The Windows Update service terminated with the following error: %%-2147467243
12/2/2012 11:50:39 PM, Error: Service Control Manager [7030] - The UDisk Monitor service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
.
==== End Of File ===========================


----------



## kevinf80 (Mar 21, 2006)

OK, do this:

Remove Combofix now that we're done with it

Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")









 Please follow the prompts to uninstall Combofix.
 You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
The above procedure will delete the following:

 ComboFix and its associated files and folders.
 VundoFix backups, if present
 The C:_OtMoveIt folder, if present
 Reset the clock settings.
 Hide file extensions, if required.
 Hide System/Hidden files, if required.
 Reset System Restore.

*It is very important that you get a successful uninstall because of the extra functions done at the same time, let me know if this does not happen.*

Next,

Delete the MBAR folder from your Desktop.

Next,


Download *OTC* by OldTimer and save it to your *desktop.* *Alternative mirror*
Double click







icon to start the program. 
If you are using Vista or Windows 7 accept UAC
Then Click the big







button.
You will get a prompt saying "_Begining Cleanup Process_". Please select *Yes*.
Restart your computer when prompted.
This will remove tools we have used and itself.

*Any tools/logs remaining on the Desktop can be deleted.*

Next,

Download







TFC to your desktop, from either of the following links
*Link 1*
*Link 2*

 Save any open work. TFC will close all open application windows.
 Double-click TFC.exe to run the program. Vista or Windows 7 users accept the UAC alert.
 If prompted, click "Yes" to reboot.
TFC will automatically close any open programs, *including your Desktop*. Let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. TFC may re-boot your system, if not *Re-boot it yourself to complete cleaning process* *<---- Very Important *

Keep TFC it is an excellent, run weekly utility to keep your system optimized, it empties all user temp folders, Java cache etc etc. *Always remember to re-boot after a run, even if not prompted*

Let me know if those steps complete OK, also tell me if there are any remaining issues or concerns.... You will need to install Service Pack 1 (SP1) ASAP....

Kevin


----------



## hendri1995 (Dec 2, 2012)

Done
There is no remaining issues now
Next?


----------



## kevinf80 (Mar 21, 2006)

That is good to hear, what next? we can close out....

Here are some tips to reduce the potential for malware infection in the future:

*Make proper use of your antivirus and firewall*

Antivirus and Firewall programs are integral to your computer security. However, just having them installed isn't enough. The definitions of these programs are frequently updated to detect the latest malware, if you don't keep up with these updates then you'll be vulnerable to infection. Many antivirus and firewall programs have automatic update features, make use of those if you can. If your program doesn't, then get in the habit of routinely performing manual updates, because it's important.

You should keep your antivirus and firewall guard enabled at all times, *NEVER* turn them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your antivirus program is a good idea to make sure you're system remains clean. Once a week should be adequate. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Install and use *WinPatrol* This will inform you of any attempted unauthorized changes to your system.

WinPatrol features explained *Here*

Go here http://www.filehippo.com/updatechecker/ run the FileHippo Update Checker, update all applications as suggested by the Update Checker. Ignore any *Beta* updates. (Use stand alone version, not a full install)
If Java or Adobe are updated please check under Start > Control Panel > Add/Remove Programs, ensure any old versions are removed. *<--- Very important*

*Use a safer web browser*

Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a few good free alternatives:

*Firefox*,

*Opera*, and

*Chrome*.

All of these are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial *HERE* which will help you to make IE *MUCH* safer.

These *browser add-ons* will help to make your browser safer:

*Web of Trust* warns you about risky websites that try to scam visitors, deliver malware or send spam. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous ones:

Available for *Firefox* and *Internet Explorer*.

*Green* to go, 
*Yellow* for caution, and 
*Red* to stop.

Available for *Firefox* only. *NoScript* helps to block malicious scripts and in general gives you much better control over what types of things webpages can do to your computer while you're browsing.

These are just a couple of the most popular add-ons, if you're interested in more, take a look at *THIS* article.

Here a couple of links by two security experts that will give some excellent tips and advice.

*So how did I get infected in the first place by Tony Klein*

*How to prevent Malware by Miekiemoes*

Finally this link *HERE* will give a comprehensive upto date list of free Security programs. To include - Antivirus, Antispyware, Firewall, Antimalware, Online scanners and rescue CD`s.

Don`t forget, the best form of defense is common sense. If you don`t recognize it, don`t open it. If something looks to good to be true, then it aint.

If no remaining issues hit the Mark Solved tab at the top of the thread,

Take care,

Kevin


----------



## hendri1995 (Dec 2, 2012)

Ok, Kevin 
Thanks for all your helps
I'm so glad to meet you


----------



## kevinf80 (Mar 21, 2006)

You`re very welcome, comback anytime....

Regards,

Kevin....


----------

