# Solved: Winlogon.exe crashing! Fatal error blue screen! Complete system instability!



## Bolen (Aug 23, 2004)

I am unaware as to what is causing this problem, but i have many concerns over how serious a problem it is. Everytime i log on to my computer the Winlogon.exe file shuts down. But my computer still continues to function normally (besides the internet running way slower then normal, and also causing the other computers on my network to do the same). However, the system stability at that point is obviously comprimised. It isnt until i pursue a more memory/graphic intensive task that my computer will have a fatal error and need to be restarted. Examples include playing World of warcraft, or having more then one browser window open at a time while surfing the internet. But it mostly occurs less then 15 minutes into a session of World of warcraft. The strange thing is, sometimes the shut down wont occur right away, but will instead seemingly happen at random times. Also as a result of whats going on to the main computer, the other computers on that network seem to be more instable then before, but not to the extent that the main computer is. Here is the error message:

STOP C000021a (fatal system error)
The windows logon process system process terminated unexpectedly with a status of Oxc0000005 (ox00000000 ox00000000)
The system has been shut down.

Guesses at to why this is occuring have ranged from trojans, to worms to power outages that have been plaguing our area. We did numerous virus scans, and did find a few things of interest which have all been cleaned from the system, but this is still occuring.

I have a process log that was created using bazooka spyware scanner, but i dont know how useful that will be in this situation.
****************************************
Bazooka Scanner v1.13.03
http://www.kephyr.com/spywarescanner/
http://www.kephyr.com/spywarescanner/library/
[email protected]
Log created 23:04:48.
OS: Windows NT 5.1
Database version: 3.220000
Database format version: 1.020000
Database date: 20060726
Current date: 2006-07-31 23:04

****************************************
Result when scanning:

No threats found.
****************************************
Auto start entries:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
C:\Program Files\CallWave\IAM.exe -start
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
C:\Program Files\CallWave\IAM.exe -start
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Documents and Settings\james bolen\Start Menu\Programs\Startup\DESKTOP.INI
C:\Documents and Settings\james bolen\Start Menu\Programs\Startup\DESKTOP.INI

Go here to analyse the startup entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Run entries:
ATIPTA C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ATIPTA

UpdateManager "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\UpdateMana ger

dla C:\WINDOWS\system32\dla\tfswctrl.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\dla

BJCFD C:\Program Files\BroadJump\Client Foundation\CFD.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\BJCFD

VSOCheckTask "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\VSOCheckTa sk

VirusScan Online c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\VirusScan Online

mmtask "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\mmtask

iTunesHelper "C:\Program Files\iTunes\iTunesHelper.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\iTunesHelp er

QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task

HostManager C:\Program Files\Common Files\AOL\1130084730\ee\AOLSoftware.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\HostManage r

Dell Photo AIO Printer 942 "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Dell Photo AIO Printer 942

DellMCM "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\DellMCM

MskAgentexe C:\Program Files\McAfee\MSK\MskAgent.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MskAgentex e

McAfee Backup C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\McAfee Backup

DellSupport "C:\Program Files\Dell Support\DSAgnt.exe" /startup
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\DellSupport

AIM C:\Program Files\AIM\aim.exe -cnetwait.odl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AIM

MSMSGS "C:\Program Files\Messenger\msmsgs.exe" /background
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS

Go here to analyse the run entries and the associated files:
http://www.kephyr.com/filedb/index.php

****************************************
Browser helper objects:

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} not set C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

{089FD14D-132B-48FC-8861-0048AE113215} not set C:\Program Files\SiteAdvisor\SiteAdv.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{089FD14D-132B-48FC-8861-0048AE113215}

{2B449E67-92A2-415C-8B34-E0EFA4452B98} not set C:\WINDOWS\system32\ocbllsdv.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{2B449E67-92A2-415C-8B34-E0EFA4452B98}

{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\ocbllsdv.dll C:\WINDOWS\system32\dla\tfswshx.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}

{AA58ED58-01DD-4d91-8333-CF10577473F7} not set c:\program files\google\googletoolbar2.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}

{B279B0F0-560C-454B-98C4-146BB5F7692a} not set C:\WINDOWS\system32\ocbllsdv.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{B279B0F0-560C-454B-98C4-146BB5F7692a}

{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} McAfee Popup Blocker c:\program files\mcafee\mps\mcpopup.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53}

{E51E39F0-245C-4B48-B0B5-B18F7F4B753b} not set C:\WINDOWS\system32\ocbllsdv.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{E51E39F0-245C-4B48-B0B5-B18F7F4B753b}

{FC148228-87E1-4D00-AC06-58DCAA52A4D1} not set C:\WINDOWS\system32\jkhhh.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{FC148228-87E1-4D00-AC06-58DCAA52A4D1}

****************************************
Toolbars:

{BA52B914-B692-46c4-B683-905236F6F655} c:\progra~1\mcafee.com\vso\mcvsshl.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{BA52B914-B692-46c4-B683-905236F6F655}

{40D41A8B-D79B-43d7-99A7-9EE0F344C385} C:\Program Files\AIM Toolbar\AIMBar.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{40D41A8B-D79B-43d7-99A7-9EE0F344C385}

{2318C2B1-4965-11d4-9B18-009027A5CD4F} c:\program files\google\googletoolbar2.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{2318C2B1-4965-11d4-9B18-009027A5CD4F}

{821F87FF-8245-4972-9E28-732E92EC2F51} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{821F87FF-8245-4972-9E28-732E92EC2F51}

{0BF43445-2F28-4351-9252-17FE6E806AA0} C:\Program Files\SiteAdvisor\SiteAdv.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0BF43445-2F28-4351-9252-17FE6E806AA0}

{01E04581-4EEE-11D0-BFE9-00AA005B4383} C:\WINDOWS\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01E04581-4EEE-11D0-BFE9-00AA005B4383}

{0E5CBF21-D15F-11D0-8301-00AA005B4383} C:\WINDOWS\system32\SHELL32.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}

{2318C2B1-4965-11D4-9B18-009027A5CD4F} c:\program files\google\googletoolbar2.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

{821F87FF-8245-4972-9E28-732E92EC2F51} Error when opening a registry key, the key doesn't exist. Key: HKEY_CLASSES_ROOT\CLSID\{821F87FF-8245-4972-9E28-732E92EC2F51}\InprocServer32

System error message: The system cannot find the file specified.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{821F87FF-8245-4972-9E28-732E92EC2F51}

{4D5C8C25-D075-11d0-B416-00C04FB90376} C:\WINDOWS\system32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}

{FE54FA40-D68C-11d2-98FA-00C0F0318AFE} C:\WINDOWS\system32\Shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}

{21569614-B795-46B1-85F4-E737A8DC09AD} C:\WINDOWS\system32\browseui.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{21569614-B795-46B1-85F4-E737A8DC09AD}

{EFA24E61-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\system32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}

{EFA24E62-B078-11D0-89E4-00C04FC9E26E} C:\WINDOWS\system32\shdocvw.dll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}

****************************************
All processes:

[System Process]
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
LSASS.EXE
ati2evxx.exe
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
spoolsv.exe
EXPLORER.EXE
AOLacsd.exe
HWAPI.exe
mclogsrv.exe
tfswctrl.exe
mcvsshld.exe
mmtask.exe
McVSEscn.exe
iTunesHelper.exe
mcagent.exe
aolsoftware.exe
dlbubmgr.exe
memcard.exe
mskagent.exe
dlbubmon.exe
McAfeeDataBackup.exe
mcupdmgr.exe
DLG.exe
McNASvc.exe
mcpromgr.exe
McProxy.exe
AOLSP Scheduler.exe
RedirSvc.exe
mctskshd.exe
mcusrmgr.exe
aolsoftware.exe
mcvsrte.exe
MpfSrv.exe
msksrver.exe
SVCHOST.EXE
wdfmgr.exe
mcvsftsn.exe
msmsgs.exe
mps.exe
mpsevh.exe
iPodService.exe
McShield.exe
ALG.EXE
mcuimgr.exe
firefox.exe
spywarescanner.exe

Go here to analyse the running processes:
http://www.kephyr.com/filedb/index.php

****************************************
Internet Explorer Settings:

Default_Page_URL http://www.dell4me.com/myway
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Default_Search_URL http://www.microsoft.com/isapi/redir...ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

Local Page C:\WINDOWS\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

Search Page http://www.microsoft.com/isapi/redir...ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://www.dell4me.com/myway
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

SearchAssistant http://www.google.com/ie
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

CustomizeSearch http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPre fix\

www http://
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\w ww

http://www.google.com/keyword/%s
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\

provider gogl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\provider

Default_Page_URL http://www.dell4me.com/myway
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

Local Page C:\WINDOWS\system32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

Search Page http://www.google.com
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

Start Page http://www.google.com/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

Use Search Asst yes
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst

****************************************

I really need the help. i dont want to have to end up reformatting the entire thing. Please let me know if my computer can be saved. Thank you. - Bolen


----------



## cybertech (Apr 16, 2002)

Hi, Welcome back to TSG!!

You have at the very least Vundo infection.

Click *here* to download *HJTsetup.exe*
Save HJTsetup.exe to your desktop.

Double click on the HJTsetup.exe icon on your desktop.
By default it will install to *C:\Program Files\Hijack This*.
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.
Click on the *Do a system scan and save a log file* button. It will scan and then ask you to save the log.
Click Save to save the log file and then the log will open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
*DO NOT* have Hijack This fix anything yet. Most of what it finds will be harmless or even required.


----------



## Bolen (Aug 23, 2004)

Logfile of HijackThis v1.99.1
Scan saved at 12:18:58 PM, on 8/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O2 - BHO: (no name) - {2B449E67-92A2-415C-8B34-E0EFA4452B98} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {B279B0F0-560C-454B-98C4-146BB5F7692a} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O2 - BHO: (no name) - {E51E39F0-245C-4B48-B0B5-B18F7F4B753b} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\jkhhh.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {821F87FF-8245-4972-9E28-732E92EC2F51} - (no file)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1130084730\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O20 - Winlogon Notify: jkhhh - C:\WINDOWS\system32\jkhhh.dll
O20 - Winlogon Notify: mtgoiqqq - C:\WINDOWS\SYSTEM32\mtgoiqqq.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\Program Files\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe


----------



## cybertech (Apr 16, 2002)

Please download *VundoFix.exe* to your desktop.
Double-click *VundoFix.exe* to run it.
Click the *Scan for Vundo* button.
Once it's done scanning, click the *Remove Vundo* button.
You will receive a prompt asking if you want to remove the files, click *YES*
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click *OK*.
Turn your computer back on.
Please post the contents of C:\*vundofix.txt* and a new HiJackThis log.


----------



## Bolen (Aug 23, 2004)

Heres the vundo file:

VundoFix V5.1.6

Checking Java version...

Java version is 1.4.2.3

Scan started at 12:27:57 PM 8/1/2006

Listing files found while scanning....

C:\WINDOWS\system32\Drivers\DP.sys

Beginning removal...

The process smss.exe was successfully stopped

The process winlogon.exe was successfully stopped

The process explorer.exe was successfully stopped

The process iexplore.exe was successfully stopped

The process rundll32.exe was successfully stopped

Attempting to delete C:\WINDOWS\system32\Drivers\DP.sys
C:\WINDOWS\system32\Drivers\DP.sys Has been deleted!

Performing Repairs to the registry.
Done!

And the hijack this file:
Logfile of HijackThis v1.99.1
Scan saved at 12:39:36 PM, on 8/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mps.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O2 - BHO: (no name) - {2B449E67-92A2-415C-8B34-E0EFA4452B98} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {B279B0F0-560C-454B-98C4-146BB5F7692a} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O2 - BHO: (no name) - {E51E39F0-245C-4B48-B0B5-B18F7F4B753b} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\jkhhh.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {821F87FF-8245-4972-9E28-732E92EC2F51} - (no file)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1130084730\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O20 - Winlogon Notify: jkhhh - C:\WINDOWS\system32\jkhhh.dll
O20 - Winlogon Notify: mtgoiqqq - C:\WINDOWS\SYSTEM32\mtgoiqqq.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\Program Files\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

What exactly are the logfiles telling you?


----------



## cybertech (Apr 16, 2002)

Bolen said:


> What exactly are the logfiles telling you?


That your computer is has multiple infections.


Double-click *VundoFix.exe* to run it. 
Put a check next to "*Run VundoFix as a task.*" 
You will receive a message saying _vundofix will close and re-open in a minute or less_. Click "*OK*". 
When VundoFix re-opens, click the "*Scan for Vundo*" button. 
Once it's done scanning, click the "*Remove Vundo*" button. 
If it says "*No infected files were found*", *right-click* the blank listbox (white box) in the main VundoFix window. 
Select "*Add More Files?*" from the menu that comes up. This will open a new VundoFix window that says "*Paste files into the box below:*" 
In the top/first field, copy and paste: *jkhhh.dll* 
Click the "*Add Files*" button. 
Click the "*Close Window*" button. 
Click the *Remove Vundo* button. 
You will receive a prompt asking if you want to remove the files, click "*YES*". 
Once you click yes, your desktop will go blank as it starts removing Vundo. 
When completed, it will prompt that it will shutdown your computer, click "*OK*". 
Turn your computer back on. 

Download *Ewido anti-spyware* from *HERE* and save that file to your desktop.

_This is a 30 day trial of the program_
Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete you will need run ewido and update the definition files.
On the main screen select the icon "*Update*" then select the "*Update now*" link.
Next select the "*Start Update*" button, the update will start and a progress bar will show the updates being installed.

Once the update has completed select the "*Scanner*" icon at the top of the screen, then select the "*Settings*" tab.
Once in the Settings screen click on "*Recommended actions*" and then select "*Quarantine*".
Under "*Reports*"
Select "*Automatically generate report after every scan*"
Un-Select "*Only if threats were found*"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
Reboot your computer into *SafeMode*. You can do this by restarting your computer and continually tapping the *F8* key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
*IMPORTANT:* Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:

Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
Select the "*Scanner*" icon at the top and then the "*Scan*" tab then click on "*Complete System Scan*".
ewido will now begin the scanning process, be patient this may take a little time.
*Once the scan is complete do the following:*
If you have any infections you will prompted, then select "*Apply all actions*"
Next select the "*Reports*" icon at the top.
Select the "*Save report as*" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan.

*Post a new HijackThis log, the log from Ewido and the contents of C:\vundofix.txt and a new HiJackThis log.*


----------



## Bolen (Aug 23, 2004)

The Scan is too longfor one post so i will be splitting it up itno 2 different posts.

+ Created at:	2:14:10 PM 8/1/2006

+ Scan result:	



HKLM\SOFTWARE\Classes\TypeLib\{7EACF70B-302F-4049-AC68-2D62EB43E473} -> Adware.SysProtect : No action taken.
C:\VundoFix Backups\jkhhh.dll -> Adware.Virtumonde : No action taken.
HKLM\SOFTWARE\Classes\CLSID\{FC148228-87E1-4D00-AC06-58DCAA52A4D1} -> Adware.Virtumonde : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC148228-87E1-4D00-AC06-58DCAA52A4D1} -> Adware.Virtumonde : No action taken.
HKU\S-1-5-21-1393003582-3513889088-3457950078-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC148228-87E1-4D00-AC06-58DCAA52A4D1} -> Adware.Virtumonde : No action taken.
C:\WINDOWS\SYSTEM32\vtsts.dll -> Downloader.Agent.yf : No action taken.
C:\Documents and Settings\darlene bolen\Desktop\SysProtectScannerInstall.exe -> Downloader.Small : No action taken.
C:\WINDOWS\SYSTEM32\adwoskcy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\agdcooix.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ahdtxwjh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ahkmqxcb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\aihdvbee.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ajnfhhme.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\alsayfxg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\amgneiqi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\anailcaw.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\aqbsduyf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\artvxbrl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\arucemwx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\askoyfan.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\atujhnll.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\avsjejmx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\aymmhuht.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bafkjwtl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bafmalpg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bcdltude.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bcnlgofs.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bcofoktf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\belqdbkj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\beunqphj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bheueoii.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bihncvpo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bkokuvtb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bljdfknb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bljhfdlv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bonyydfh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bpxetwku.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\brfpjlgb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\buptokgl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bvuuyqtn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bwdvcmpr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\bwiqriqo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cacqybto.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cdtejgiy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cfkkfbjf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cfvlevah.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cgcirnwo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cixrwggt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ckhagthr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\clbifkkv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\clqwdqdp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cmreebbe.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cndtixbf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\codwbhgm.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\coxriaxt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\coynwniu.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cpqyqbtl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\csbcmgny.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\csfrjgan.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cvvvofam.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cvxfsdgl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cygtiqxc.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\cywkjqnx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dbdxwdwb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dcskvnsq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ddyyclss.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dgqhdphp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dhunsonq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dhuxhvho.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\djvosunr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dkjijqjg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dmlbbxub.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dnokadbl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dpvmsidj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dqfadqxa.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dqppjthd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dsnavtjt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dvsrucbw.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\dyqftsoi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\eadallrv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\eaydmpkx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\edcwkgol.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\eddiimuk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ehhoiswh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ejusbgsy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\enbgxhnp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\eoxhscec.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\eprbppyp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\eqkqdfpj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\erfhevtq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\euaflvet.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\evjkfplc.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ewpuaxoe.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ewxcxxbp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\eybiuygo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fbngkxvk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fbykdkji.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fcgxojuj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fcmshgty.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fdjjvyvl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fkiwgxlo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fkpnsput.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fnhelgrx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fqltbjrq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\frmkwint.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ftgxlidi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ftombxgg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fttrjoyh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\fyybhpsb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gaabqtot.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gcqlqygj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gcubytdx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ghbarmfw.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ghgcbgli.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\giabtjno.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gifrlppa.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gitwjelc.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\glsoutyn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gmfrfnsh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gncacaxr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gnwvdwke.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gpcnxkrw.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\grghdacu.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gsxjvesd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gtwybymx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\guxtxnor.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gwssaijp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gxgpopde.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gyhmycfh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gykqumpf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\gyrdpkyr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hdmafjfi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hehrqqvt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hewklumd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hfstsctb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hgmrmvyc.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hhqbmrkk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hifoeodu.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hjvlenbx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hjvmotra.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hjxqysyi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hkdpfvqy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hldhsich.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hogmrfld.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hokhhumo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hqjrvtrg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hrqggixm.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\htcuwbia.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hwurlggl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hwwxomle.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\hxwvjqxk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ibybrxse.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ifjdoxnv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ihqttabt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ihygqmnk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ijgawfkh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ikprrgst.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ilfrqeqh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\innsscmg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\irgkixhh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ismlruwn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ivohosut.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\iwdynmfj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\iynqddqe.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jeogonxd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jitjvgrq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jkllnwpf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jpbeslrm.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jqlksbxr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jrjabksk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jsvxtltt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jtyfcyog.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\juughhht.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jxjpqicg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jyavwywa.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\jykcwwqr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\kacglaol.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\kbgylkcm.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\kcbbwyer.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\kiervihb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\kkjtmwud.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\kobllmvl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\korhdlro.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\krjxxxfh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\kuugawsu.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\kvmowdih.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\kyfkqfvv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\lluypyqq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\lrbyjujp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\lwaeiskk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\lwqlkvxn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\lyssstld.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mduaofje.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mgiawugk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mgrtlbdu.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mhncvryp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mhwyckaa.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mlksreuo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mlposivn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mlrcsxkn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mmxluesx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mobkujxq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mueccxfd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\muhljiwd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\mxupxtie.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\naruvhsf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nboysore.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ndhhsvng.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ndrwgetp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\neqipasi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nfoimbqc.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nixgmcfy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\njpbxlds.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nkxnagaw.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nmrdbemt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nojkynwf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nrwcdkto.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nvbqvjff.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nvpckchn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\nxghhrxv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\oaicnanq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\oaignefi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\obhfwqwe.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\objekvgf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\obnbgfap.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\odqehtke.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ofebryme.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ohfchdom.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\oiyxriqd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\okrfgmyf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\opaoyfqe.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\osfjsuot.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\osqqaoyn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\osrfpasr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\otggfhkh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\oumaugso.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ouqtjouk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\owtmqcnq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\oxhmurpy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\pjmqlrhx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\pjqjsrah.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\pkdxsxwb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\plbokfvf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\plckwwgj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\pqebsnfk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\pwkiplud.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\pwwbsoae.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qatmsrlw.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qgqjesny.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qikhecne.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qjsgwjhv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qmevqvpw.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qrhbfqsc.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qrnysmfp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qrqfjtcc.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qvfkfcoc.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qydfndft.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\qykmrmrh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rbyvffcr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rcjbraji.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rcypddlh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rjkbqdhn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rjocidbe.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rlosvgts.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\roahgdhx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rrelbmpy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rrrjuwrt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rrvffhdg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rthsbnhn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\rwaxeavo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sapuilyo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sasghyff.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sboputub.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\scsvjbtg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\scwdcnkb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sewynjgp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sfwdsbrq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sggscong.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sltofvxs.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\smebgibi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\smjbdkqv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\spuyugch.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\spvwgjxn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sqyviwfr.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sufvjfcy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\swgqobaq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\swtoimtn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sxtyluru.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sxytqsha.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\sysjaprh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tewgirjp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\teychgks.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tgkvlxmb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tgkvpsvt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\thjauhpd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tilphnqo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tmkqnmjh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tnellybb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tpeolkes.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tqqlkwbk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\trcshnig.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\trnjetnx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tsyqofhl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ttmsjrrs.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\tuyewumi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\twoxnmdv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uanhrhpm.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ucrbueqy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uflkngdi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uhjpogjq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uimclppm.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uknoyord.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\umiwnkqc.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\umvapkns.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\upioctas.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\upwguuvm.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uqluvfpi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uqmtlneb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uqscxhst.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\usddpbtl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uspbnosp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\utvulkjl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\uykwcerv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vbcngeue.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vdrdxxka.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vhkvutqp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\viajlwco.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vjyylovt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vkitykyj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vlbshlps.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vmfbdhrd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vmymbphi.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vqderlew.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vrtqmrnv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vtvjvkmn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vunapakf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vvsblhug.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vxcguijd.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\vxniqlsy.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\waemdlrw.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wbyitsri.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wbyxldnj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wdhalnyj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\whsudnlf.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wjanlwee.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wnpsqfnm.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wqymhcgt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wrdblujn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wwooyvwn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wwtehdhg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wxspvkeq.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\wynnevhn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xdtrjutl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xfhcgrds.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xgqmppbh.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xgueqmtt.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xiednasu.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xjccrwue.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xkbxwnww.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xknlfslu.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xldruyjn.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xndmnenk.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xqyhayrg.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xudvxpew.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xyfkfayp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\xyvosbol.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\yaeflbfl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ybaljodp.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ycbsikpj.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ycemdjcv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ycrugxip.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ycxrqpjl.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ydvagphv.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\yeaawrok.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\yeaejova.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\yipawygb.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\yjdqbdqs.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\yjjojnau.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ykmipvuo.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\yofnfmjx.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\ypkbjuvs.dll -> Logger.Agent.kg : No action taken.
C:\WINDOWS\SYSTEM32\yqckikyb.dll -> Logger.Agent.kg : No action taken.


----------



## Bolen (Aug 23, 2004)

C:\WINDOWS\Downloaded Program Files\UWFX5_0001_NI53TESTNetInstaller.exe -> Not-A-Virus.Downloader.Win32.Agent.f : No action taken.
C:\WINDOWS\Downloaded Program Files\UWFX6_0001_N57M0912NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : No action taken.
:mozilla.272:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.630:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.671:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.704:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.854:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.987:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\darlene bolen\Cookies\darlene [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\darlene bolen\Cookies\darlene [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\darlene bolen\Cookies\darlene [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][2].txt -> TrackingCookie.7search : No action taken.
:mozilla.563:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : No action taken.
:mozilla.601:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : No action taken.
:mozilla.602:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : No action taken.
:mozilla.614:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : No action taken.
:mozilla.625:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : No action taken.
:mozilla.651:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : No action taken.
:mozilla.652:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Aavalue : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Aavalue : No action taken.
:mozilla.523:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Adjuggler : No action taken.
:mozilla.524:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Adjuggler : No action taken.
:mozilla.525:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Adjuggler : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Adjuggler : No action taken.
:mozilla.74:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.77:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.80:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.82:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][1].txt -> TrackingCookie.Advertising : No action taken.
:mozilla.88:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][2].txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.389:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Burstbeacon : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Burstbeacon : No action taken.
:mozilla.376:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Burstnet : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Clickhype : No action taken.
:mozilla.936:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.937:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Com : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Com : No action taken.
:mozilla.970:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Cpvfeed : No action taken.
:mozilla.971:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Cpvfeed : No action taken.
:mozilla.972:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Cpvfeed : No action taken.
:mozilla.973:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Cpvfeed : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Cpvfeed : No action taken.
:mozilla.72:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\darlene bolen\Cookies\darlene [email protected][1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Epilot : No action taken.
:mozilla.828:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : No action taken.
:mozilla.866:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : No action taken.
:mozilla.876:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : No action taken.
:mozilla.883:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : No action taken.
:mozilla.918:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : No action taken.
:mozilla.919:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Esomniture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.89:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.90:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.91:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][2].txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][1].txt -> TrackingCookie.Findwhat : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Goclick : No action taken.
:mozilla.798:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Kmpads : No action taken.
:mozilla.799:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Kmpads : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Kmpads : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Linksynergy : No action taken.
:mozilla.784:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Masterstats : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Masterstats : No action taken.
:mozilla.73:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.181:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.258:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.259:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.260:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.262:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.264:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.265:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.266:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.267:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.268:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.269:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Myaffiliateprogram : No action taken.
:mozilla.583:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Overture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Overture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Overture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Overture : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Realcastmedia : No action taken.
:mozilla.420:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.421:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.422:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.423:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.424:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.425:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.426:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.427:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.428:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.429:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.430:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.431:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.432:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.433:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.948:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Specificclick : No action taken.
:mozilla.379:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Starware : No action taken.
:mozilla.844:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Starware : No action taken.
:mozilla.845:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Starware : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Starware : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Starware : No action taken.
:mozilla.7:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.532:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.533:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Tacoda : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.731:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tracking101 : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Tracking101 : No action taken.
:mozilla.68:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.69:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.70:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.71:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.81:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.
:mozilla.83:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][1].txt -> TrackingCookie.Webtrendslive : No action taken.
:mozilla.169:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.170:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][2].txt -> TrackingCookie.Zedo : No action taken.
C:\VundoFix Backups\DP.sys -> Trojan.Agent.ny : No action taken.
C:\WINDOWS\SYSTEM32\hhhkxvwt.exe -> Trojan.Agent.ny : No action taken.
C:\WINDOWS\SYSTEM32\hvpvcmow.exe -> Trojan.Agent.ny : No action taken.
C:\WINDOWS\SYSTEM32\ouaaibmg.exe -> Trojan.Agent.ny : No action taken.
C:\WINDOWS\SYSTEM32\peonnpmt.exe -> Trojan.Agent.ny : No action taken.
C:\WINDOWS\SYSTEM32\sujfaqdp.exe -> Trojan.Agent.ny : No action taken.
C:\WINDOWS\SYSTEM32\wvllpwlm.exe -> Trojan.Agent.ny : No action taken.
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\USYP_0001_N69M1703NetInstaller.exe -> Trojan.Fakealert : No action taken.
C:\WINDOWS\Downloaded Program Files\USYP_0001_N69M1703NetInstaller.exe -> Trojan.Fakealert : No action taken.

::Report end


----------



## Bolen (Aug 23, 2004)

And the hijack this logfiles and vundo logs...

Logfile of HijackThis v1.99.1
Scan saved at 2:21:52 PM, on 8/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O2 - BHO: (no name) - {2B449E67-92A2-415C-8B34-E0EFA4452B98} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {B279B0F0-560C-454B-98C4-146BB5F7692a} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O2 - BHO: (no name) - {E51E39F0-245C-4B48-B0B5-B18F7F4B753b} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\jkhhh.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {821F87FF-8245-4972-9E28-732E92EC2F51} - (no file)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1130084730\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O20 - Winlogon Notify: mtgoiqqq - C:\WINDOWS\SYSTEM32\mtgoiqqq.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\Program Files\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

VundoFix V5.1.6

Checking Java version...

Java version is 1.4.2.3

Scan started at 12:27:57 PM 8/1/2006

Listing files found while scanning....

C:\WINDOWS\system32\Drivers\DP.sys

Beginning removal...

The process smss.exe was successfully stopped

The process winlogon.exe was successfully stopped

The process explorer.exe was successfully stopped

The process iexplore.exe was successfully stopped

The process rundll32.exe was successfully stopped

Attempting to delete C:\WINDOWS\system32\Drivers\DP.sys
C:\WINDOWS\system32\Drivers\DP.sys Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V5.1.6

Running as SYSTEM
from c:\windows\system32\VundoFix.exe

Checking Java version...

Java version is 1.4.2.3

Scan started at 1:08:10 PM 8/1/2006

Listing files found while scanning....

No infected files were found.

Beginning removal...

The process smss.exe was successfully stopped

The process winlogon.exe was successfully stopped

The process explorer.exe was successfully stopped

The process iexplore.exe was successfully stopped

The process rundll32.exe was successfully stopped

Attempting to delete jkhhh.dll
jkhhh.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V5.1.6

Running as SYSTEM
from c:\windows\system32\VundoFix.exe

Checking Java version...

Java version is 1.4.2.3

Scan started at 1:14:09 PM 8/1/2006

Listing files found while scanning....

No infected files were found.

Beginning removal...


----------



## cybertech (Apr 16, 2002)

*Run ewido again and please take time to set it up to remove those infections! Print this out or copy it to notepad so you will have it available.*


Select the "*Scanner*" icon at the top of the screen, then select the "*Settings*" tab.
Once in the Settings screen click on "*Recommended actions*" and then select "*Quarantine*".
Under "*Reports*"
Select "*Automatically generate report after every scan*"
Un-Select "*Only if threats were found*"

*Reboot your computer into SafeMode*.


Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
Select the "*Scanner*" icon at the top and then the "*Scan*" tab then click on "*Complete System Scan*".
ewido will now begin the scanning process, be patient this may take a little time.
*Once the scan is complete do the following:*
If you have any infections you will prompted, then select "*Apply all actions*"
Next select the "*Reports*" icon at the top.
Select the "*Save report as*" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan.

*Post a new HijackThis log and the log from Ewido.*


----------



## Bolen (Aug 23, 2004)

+ Created at:	4:41:04 PM 8/1/2006

+ Scan result:	



HKLM\SOFTWARE\Classes\TypeLib\{7EACF70B-302F-4049-AC68-2D62EB43E473} -> Adware.SysProtect : Cleaned with backup (quarantined).
C:\VundoFix Backups\jkhhh.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{FC148228-87E1-4D00-AC06-58DCAA52A4D1} -> Adware.Virtumonde : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC148228-87E1-4D00-AC06-58DCAA52A4D1} -> Adware.Virtumonde : Cleaned with backup (quarantined).
HKU\S-1-5-21-1393003582-3513889088-3457950078-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC148228-87E1-4D00-AC06-58DCAA52A4D1} -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vtsts.dll -> Downloader.Agent.yf : Cleaned with backup (quarantined).
C:\Documents and Settings\darlene bolen\Desktop\SysProtectScannerInstall.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\adwoskcy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\agdcooix.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ahdtxwjh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ahkmqxcb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\aihdvbee.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ajnfhhme.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\alsayfxg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\amgneiqi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\anailcaw.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\aqbsduyf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\artvxbrl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\arucemwx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\askoyfan.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\atujhnll.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\avsjejmx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\aymmhuht.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bafkjwtl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bafmalpg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bcdltude.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bcnlgofs.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bcofoktf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\belqdbkj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\beunqphj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bheueoii.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bihncvpo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bkokuvtb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bljdfknb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bljhfdlv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bonyydfh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bpxetwku.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\brfpjlgb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\buptokgl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bvuuyqtn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bwdvcmpr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\bwiqriqo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cacqybto.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cdtejgiy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cfkkfbjf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cfvlevah.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cgcirnwo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cixrwggt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ckhagthr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\clbifkkv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\clqwdqdp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cmreebbe.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cndtixbf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\codwbhgm.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\coxriaxt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\coynwniu.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cpqyqbtl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\csbcmgny.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\csfrjgan.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cvvvofam.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cvxfsdgl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cygtiqxc.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\cywkjqnx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dbdxwdwb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dcskvnsq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ddyyclss.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dgqhdphp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dhunsonq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dhuxhvho.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\djvosunr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dkjijqjg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dmlbbxub.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dnokadbl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dpvmsidj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dqfadqxa.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dqppjthd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dsnavtjt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dvsrucbw.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\dyqftsoi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\eadallrv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\eaydmpkx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\edcwkgol.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\eddiimuk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ehhoiswh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ejusbgsy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\enbgxhnp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\eoxhscec.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\eprbppyp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\eqkqdfpj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\erfhevtq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\euaflvet.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\evjkfplc.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ewpuaxoe.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ewxcxxbp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\eybiuygo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fbngkxvk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fbykdkji.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fcgxojuj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fcmshgty.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fdjjvyvl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fkiwgxlo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fkpnsput.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fnhelgrx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fqltbjrq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\frmkwint.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ftgxlidi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ftombxgg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fttrjoyh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\fyybhpsb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gaabqtot.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gcqlqygj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gcubytdx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ghbarmfw.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ghgcbgli.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\giabtjno.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gifrlppa.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gitwjelc.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\glsoutyn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gmfrfnsh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gncacaxr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gnwvdwke.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gpcnxkrw.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\grghdacu.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gsxjvesd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gtwybymx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\guxtxnor.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gwssaijp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gxgpopde.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gyhmycfh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gykqumpf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\gyrdpkyr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hdmafjfi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hehrqqvt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hewklumd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hfstsctb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hgmrmvyc.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hhqbmrkk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hifoeodu.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hjvlenbx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hjvmotra.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hjxqysyi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hkdpfvqy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hldhsich.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hogmrfld.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hokhhumo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hqjrvtrg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hrqggixm.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\htcuwbia.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hwurlggl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hwwxomle.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hxwvjqxk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ibybrxse.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ifjdoxnv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ihqttabt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ihygqmnk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ijgawfkh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ikprrgst.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ilfrqeqh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\innsscmg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\irgkixhh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ismlruwn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ivohosut.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\iwdynmfj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\iynqddqe.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jeogonxd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jitjvgrq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jkllnwpf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jpbeslrm.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jqlksbxr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jrjabksk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jsvxtltt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jtyfcyog.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\juughhht.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jxjpqicg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jyavwywa.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\jykcwwqr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\kacglaol.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\kbgylkcm.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\kcbbwyer.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\kiervihb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\kkjtmwud.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\kobllmvl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\korhdlro.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\krjxxxfh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\kuugawsu.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\kvmowdih.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\kyfkqfvv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\lluypyqq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\lrbyjujp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\lwaeiskk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\lwqlkvxn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\lyssstld.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mduaofje.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mgiawugk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mgrtlbdu.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mhncvryp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mhwyckaa.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mlksreuo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mlposivn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mlrcsxkn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mmxluesx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mobkujxq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mueccxfd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\muhljiwd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\mxupxtie.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\naruvhsf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nboysore.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ndhhsvng.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ndrwgetp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\neqipasi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nfoimbqc.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nixgmcfy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\njpbxlds.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nkxnagaw.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nmrdbemt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nojkynwf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nrwcdkto.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nvbqvjff.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nvpckchn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\nxghhrxv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\oaicnanq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\oaignefi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\obhfwqwe.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\objekvgf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\obnbgfap.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\odqehtke.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ofebryme.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ohfchdom.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\oiyxriqd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\okrfgmyf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\opaoyfqe.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\osfjsuot.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\osqqaoyn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\osrfpasr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\otggfhkh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\oumaugso.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ouqtjouk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\owtmqcnq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\oxhmurpy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\pjmqlrhx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\pjqjsrah.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\pkdxsxwb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\plbokfvf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\plckwwgj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\pqebsnfk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\pwkiplud.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\pwwbsoae.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qatmsrlw.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qgqjesny.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qikhecne.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qjsgwjhv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qmevqvpw.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qrhbfqsc.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qrnysmfp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qrqfjtcc.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qvfkfcoc.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qydfndft.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\qykmrmrh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rbyvffcr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rcjbraji.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rcypddlh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rjkbqdhn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rjocidbe.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rlosvgts.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\roahgdhx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rrelbmpy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rrrjuwrt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rrvffhdg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rthsbnhn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\rwaxeavo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sapuilyo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sasghyff.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sboputub.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\scsvjbtg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\scwdcnkb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sewynjgp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sfwdsbrq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sggscong.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sltofvxs.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\smebgibi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\smjbdkqv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\spuyugch.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\spvwgjxn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sqyviwfr.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sufvjfcy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\swgqobaq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\swtoimtn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sxtyluru.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sxytqsha.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sysjaprh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tewgirjp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\teychgks.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tgkvlxmb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tgkvpsvt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\thjauhpd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tilphnqo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tmkqnmjh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tnellybb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tpeolkes.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tqqlkwbk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\trcshnig.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\trnjetnx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tsyqofhl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ttmsjrrs.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\tuyewumi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\twoxnmdv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\uanhrhpm.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ucrbueqy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\uflkngdi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\uhjpogjq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\uimclppm.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\uknoyord.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\umiwnkqc.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\umvapkns.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\upioctas.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\upwguuvm.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\uqluvfpi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).


----------



## Bolen (Aug 23, 2004)

C:\WINDOWS\SYSTEM32\uqmtlneb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\uqscxhst.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\usddpbtl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\uspbnosp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\utvulkjl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\uykwcerv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vbcngeue.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vdrdxxka.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vhkvutqp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\viajlwco.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vjyylovt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vkitykyj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vlbshlps.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vmfbdhrd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vmymbphi.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vqderlew.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vrtqmrnv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vtvjvkmn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vunapakf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vvsblhug.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vxcguijd.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\vxniqlsy.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\waemdlrw.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wbyitsri.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wbyxldnj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wdhalnyj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\whsudnlf.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wjanlwee.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wnpsqfnm.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wqymhcgt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wrdblujn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wwooyvwn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wwtehdhg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wxspvkeq.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wynnevhn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xdtrjutl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xfhcgrds.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xgqmppbh.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xgueqmtt.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xiednasu.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xjccrwue.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xkbxwnww.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xknlfslu.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xldruyjn.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xndmnenk.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xqyhayrg.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xudvxpew.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xyfkfayp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xyvosbol.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\yaeflbfl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ybaljodp.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ycbsikpj.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ycemdjcv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ycrugxip.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ycxrqpjl.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ydvagphv.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\yeaawrok.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\yeaejova.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\yipawygb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\yjdqbdqs.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\yjjojnau.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ykmipvuo.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\yofnfmjx.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ypkbjuvs.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\yqckikyb.dll -> Logger.Agent.kg : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\UWFX5_0001_NI53TESTNetInstaller.exe -> Not-A-Virus.Downloader.Win32.Agent.f : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\UWFX6_0001_N57M0912NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Cleaned with backup (quarantined).
:mozilla.273:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.631:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.672:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.705:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.855:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.987:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\darlene bolen\Cookies\darlene [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\darlene bolen\Cookies\darlene [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\darlene bolen\Cookies\darlene [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][2].txt -> TrackingCookie.7search : Cleaned with backup (quarantined).
:mozilla.564:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.602:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.603:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.615:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.626:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.652:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.653:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.524:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
:mozilla.525:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
:mozilla.526:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
:mozilla.24:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.25:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.26:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.28:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][1].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.31:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.390:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
:mozilla.377:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Clickhype : Cleaned with backup (quarantined).
:mozilla.936:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
:mozilla.937:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
:mozilla.970:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.971:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.972:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.973:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.30:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\darlene bolen\Cookies\darlene [email protected][1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Epilot : Cleaned with backup (quarantined).
:mozilla.829:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
:mozilla.867:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
:mozilla.877:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
:mozilla.883:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
:mozilla.918:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
:mozilla.919:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.90:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.91:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.92:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][2].txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][1].txt -> TrackingCookie.Findwhat : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined).
:mozilla.799:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Kmpads : Cleaned with backup (quarantined).
:mozilla.800:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Kmpads : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Kmpads : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Linksynergy : Cleaned with backup (quarantined).
:mozilla.785:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined).
:mozilla.89:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
:mozilla.182:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.259:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.260:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.261:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.263:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.265:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.266:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.267:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.268:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.269:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.270:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.584:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Realcastmedia : Cleaned with backup (quarantined).
:mozilla.421:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.422:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.423:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.424:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.425:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.426:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.427:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.428:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.429:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.430:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.431:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.432:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.433:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.434:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.948:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.380:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
:mozilla.845:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
:mozilla.846:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
:mozilla.7:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.533:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.534:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.732:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][2].txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined).
:mozilla.85:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.86:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.87:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.88:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.16:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).


----------



## Bolen (Aug 23, 2004)

:mozilla.18:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][1].txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).
:mozilla.170:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.171:C:\Documents and Settings\james bolen\Application Data\Mozilla\Firefox\Profiles\ij5u9vb5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Cookies\james [email protected][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\Documents and Settings\james bolen\Local Settings\Temp\Cookies\james [email protected][2].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
C:\VundoFix Backups\DP.sys -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hhhkxvwt.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\hvpvcmow.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\ouaaibmg.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\peonnpmt.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\sujfaqdp.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\wvllpwlm.exe -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\USYP_0001_N69M1703NetInstaller.exe -> Trojan.Fakealert : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\USYP_0001_N69M1703NetInstaller.exe -> Trojan.Fakealert : Cleaned with backup (quarantined).

::Report end


----------



## Bolen (Aug 23, 2004)

Logfile of HijackThis v1.99.1
Scan saved at 4:57:57 PM, on 8/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mps.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\iTunes\iTunesHelper.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Common Files\AOL\1130084730\ee\AOLSoftware.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
c:\program files\common files\aol\1130084730\ee\services\antiSpywareApp\ver2_0_25_1\AOLSP Scheduler.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
c:\program files\common files\aol\1130084730\ee\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Digital Line Detect\DLG.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\NOTEPAD.EXE
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O2 - BHO: (no name) - {2B449E67-92A2-415C-8B34-E0EFA4452B98} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {B279B0F0-560C-454B-98C4-146BB5F7692a} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O2 - BHO: (no name) - {E51E39F0-245C-4B48-B0B5-B18F7F4B753b} - C:\WINDOWS\system32\ocbllsdv.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {821F87FF-8245-4972-9E28-732E92EC2F51} - (no file)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1130084730\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O20 - Winlogon Notify: mtgoiqqq - C:\WINDOWS\SYSTEM32\mtgoiqqq.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\Program Files\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe


----------



## cybertech (Apr 16, 2002)

Nice job!!

Go to this web site: http://virusscan.jotti.org/
In the File to upload & scan box copy and paste: *C:\WINDOWS\system32\ocbllsdv.dll*

Then click the Submit button.

Copy the results and paste the results back here in your next reply.


----------



## Bolen (Aug 23, 2004)

Service load: 
0% 100%
File: ocbllsdv.dll
Status: 
INFECTED/MALWARE
MD5 cf18ccea3bc89d63a44f1bbdd5ef3606
Packers detected: 
-
Scanner results
AntiVir 
Found nothing
ArcaVir 
Found nothing
Avast 
Found nothing
AVG Antivirus 
Found nothing
BitDefender 
Found nothing
ClamAV 
Found nothing
Dr.Web 
Found Adware.Hotbot
F-Prot Antivirus 
Found nothing
Fortinet 
Found nothing
Kaspersky Anti-Virus 
Found nothing
NOD32 
Found nothing
Norman Virus Control 
Found nothing
UNA 
Found nothing
VirusBuster 
Found nothing
VBA32 
Found nothing


----------



## cybertech (Apr 16, 2002)

*Click Here* and download Killbox and save it to your desktop.

Double-click on Killbox.exe to run it. 
Put a tick by *Delete on Reboot*. 
Copy the following list of files to clipboard, CTRL+C to copy


> C:\WINDOWS\SYSTEM32\mtgoiqqq.dll
> C:\WINDOWS\system32\ocbllsdv.dll


Now in Killbox go to File, Paste from clipboard.
Click the All Files button.
Click on the button that has the red circle with the X in the middle.
It will ask for confimation to delete the file. 
Click Yes. 
It will ask if you want to reboot now,
Click *NO.*

*Run HJT again and put a check in the following:*

O2 - BHO: (no name) - {2B449E67-92A2-415C-8B34-E0EFA4452B98} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: (no name) - {B279B0F0-560C-454B-98C4-146BB5F7692a} - C:\WINDOWS\system32\ocbllsdv.dll
O2 - BHO: (no name) - {E51E39F0-245C-4B48-B0B5-B18F7F4B753b} - C:\WINDOWS\system32\ocbllsdv.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll (file missing)
O3 - Toolbar: (no name) - {821F87FF-8245-4972-9E28-732E92EC2F51} - (no file)
O20 - Winlogon Notify: mtgoiqqq - C:\WINDOWS\SYSTEM32\mtgoiqqq.dll

*Close all applications and browser windows before you click "fix checked".*

Now reboot and post your log again.


----------



## Bolen (Aug 23, 2004)

Logfile of HijackThis v1.99.1
Scan saved at 6:16:37 PM, on 8/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mps.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1130084730\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O20 - Winlogon Notify: mtgoiqqq - mtgoiqqq.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\Program Files\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe


----------



## cybertech (Apr 16, 2002)

*Run HJT again and put a check in the following:*

O20 - Winlogon Notify: mtgoiqqq - mtgoiqqq.dll (file missing)

*Close all applications and browser windows before you click "fix checked".*

Reboot the machine, run HJT again and make sure it's gone! If not let me know and we'll use other ways to remove it.

How is it running now?

Notice any problems?


----------



## Bolen (Aug 23, 2004)

Logfile of HijackThis v1.99.1
Scan saved at 6:44:24 PM, on 8/1/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\1130084730\ee\AOLSoftware.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1130084730\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBackMonitor - - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\Program Files\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

Its gone, now... care to explain what the hell i just went through??!  Internet seems to be running much smoother now,. could having mcafee running like 30 apps in the backround make the system unstable? we dont even use the prog so much so should i just delete it? Thank you thus far in the process, should this end the blue screens i was getting?


----------



## cybertech (Apr 16, 2002)

Bolen said:


> Its gone, now... care to explain what the hell i just went through??!  Internet seems to be running much smoother now,. could having mcafee running like 30 apps in the backround make the system unstable? we dont even use the prog so much so should i just delete it? Thank you thus far in the process, should this end the blue screens i was getting?


Wild ride!

You just went through a major infection so at this point it's a good idea to Flush your System Restore after removing the malware:


 On the Desktop, right-click My Computer. 
 Click Properties. 
 Click the System Restore tab. 
 Check Turn off System Restore. 
 Click Apply, and then click OK. 
 Restart the computer. 

To create a new restore point: 

Start go to All Programs 
Accessories, System Tools and select System Restore. 
In the System Restore wizard, select "Create a restore point" and click the Next button. 
Type a description for your new restore point. Something like "After trojan/spyware cleanup". 
Click Create and you're done.

Check in tomorrow and let me know how things are going or you mark the thread as solved with the Thread Tools at the top of the page.


----------



## Bolen (Aug 23, 2004)

My computer is fixed thanks to you! thank you!


----------



## cybertech (Apr 16, 2002)

Great!

You're welcome!!


----------

