BleepingComputer.com: Multiple Infections - Please Help

I would be grateful if someone could help me with this infected PC. Below is the DDS.txt log as requested and I have also attached zipped Attach.txt log. In addition I have attached zipped anti-virus ClamWin and Kaspersky Online Scanner scan logs for additional reference:

================================DDS Log=================================


DDS (Ver_09-03-16.01) - NTFSx86
Run by Gemma at 5:33:13.70 on 13/05/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2039.1564 [GMT 1:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\ClamWin\bin\ClamTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\HP UT\bin\hppusg.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Gemma\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {577EBCA9-8ED3-45FC-A514-55B3817D4BCF} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [ClamWin] "c:\program files\clamwin\bin\ClamTray.exe" --logon
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [ToolBoxFX] "c:\program files\hp\toolboxfx\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [HPUsageTracking] "c:\program files\hp\hp ut\bin\hppusg.exe" "c:\program files\hp\hp ut\"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1198156548328
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1198164892156
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: {38B12A38-EE0C-4186-B532-29D63ECEE449} = 192.168.6.1
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Notify: igfxcui - igfxsrvc.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\gemma\applic~1\mozilla\firefox\profiles\kxo8vkkk.default\
FF - component: c:\documents and settings\gemma\application data\mozilla\firefox\profiles\kxo8vkkk.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc.dll
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\picasa3\npPicasa2.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.2.145.5\npGoogleOneClick8.dll

============= SERVICES / DRIVERS ===============

S2 gupdate1c9890676d31988;Google Update Service (gupdate1c9890676d31988);c:\program files\google\update\GoogleUpdate.exe [2009-2-7 133104]

=============== Created Last 30 ================

2009-05-12 15:59 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-05-12 15:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-05-12 08:38 <DIR> a-dshr-- C:\cmdcons
2009-05-12 08:36 161,792 a------- c:\windows\SWREG.exe
2009-05-12 08:36 98,816 a------- c:\windows\sed.exe
2009-05-12 08:28 <DIR> --d----- c:\docume~1\gemma\applic~1\Malwarebytes
2009-05-12 08:28 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-05-12 06:04 <DIR> --dsh--- c:\documents and settings\gemma\IECompatCache
2009-05-12 06:03 <DIR> --dsh--- c:\documents and settings\gemma\PrivacIE
2009-05-12 06:03 <DIR> --dsh--- c:\documents and settings\gemma\IETldCache
2009-05-12 05:50 <DIR> --d----- c:\windows\ie8updates
2009-05-12 05:49 102,400 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-05-12 05:46 <DIR> -cd-h--- c:\windows\ie8
2009-04-28 17:50 <DIR> --d----- c:\windows\system32\appmgmt
2009-04-28 05:40 410,984 a------- c:\windows\system32\deploytk.dll
2009-04-28 05:40 73,728 a------- c:\windows\system32\javacpl.cpl
2009-04-28 05:20 <DIR> --d----- c:\program files\iPod
2009-04-28 05:20 <DIR> --d----- c:\program files\iTunes
2009-04-28 05:20 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-21 13:11 <DIR> --d----- c:\program files\MSXML 4.0
2009-04-21 13:08 144 a------- c:\windows\Readiris.ini
2009-04-21 13:07 <DIR> --d----- c:\program files\Readiris Pro 11 HP
2009-04-21 13:05 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-04-21 13:05 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
2009-04-21 13:05 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
2009-04-17 17:39 <DIR> --d----- c:\program files\common files\HP
2009-04-17 17:39 <DIR> --d----- c:\docume~1\alluse~1\applic~1\zvprt50
2009-04-17 17:39 608 a--sh--- c:\windows\system32\winzvprt5.sys
2009-04-17 17:39 13,385 -------- c:\windows\system32\hppfaxprintermon5.dll
2009-04-17 17:39 9,451 -------- c:\windows\system32\hppfaxprintermonui5.dll
2009-04-17 17:37 <DIR> --d----- c:\program files\common files\Hewlett-Packard
2009-04-17 17:36 876,544 a----r-- c:\windows\system32\hpxp2727.dll
2009-04-17 17:36 733,184 a----r-- c:\windows\system32\hpptsp02.dll
2009-04-17 17:36 450,560 a----r-- c:\windows\system32\hppasc07.dll
2009-04-17 17:36 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
2009-04-17 17:36 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2009-04-17 17:36 327,680 a----r-- c:\windows\system32\hppcpr07.dll
2009-04-17 17:36 685 a----r-- c:\windows\system32\hppapr07.dat
2009-04-17 17:36 59,928 a------- c:\windows\system32\fxcompchannel.dll
2009-04-17 17:35 138 a------- c:\windows\system32\AddPort.ini
2009-04-17 17:35 770 a------- c:\windows\hpntwksetup.ini
2009-04-17 17:32 <DIR> --d----- c:\program files\HP
2009-04-17 17:32 25,856 ac------ c:\windows\system32\dllcache\usbprint.sys
2009-04-17 17:32 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-04-17 17:31 153,527 a------- c:\windows\hppins07.dat
2009-04-17 17:31 153,486 a------- c:\windows\system32\hppins07.dat
2009-04-17 17:31 838 -------- c:\windows\hppmdl07.dat

==================== Find3M ====================

2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-16 03:58 499,712 a------- c:\windows\system32\msvcp71.dll
2009-03-16 03:58 348,160 a------- c:\windows\system32\msvcr71.dll
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-06 15:22 284,160 a------- c:\windows\system32\pdh.dll
2009-02-25 09:01 87,263 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2002-04-16 11:27 5 a--sh--- c:\windows\system32\CdI5T.drv
1998-03-20 01:00 1,048 a--sh--- c:\windows\system32\flfnlf.sys
1998-03-20 01:00 1,048 a--sh--- c:\windows\system32\rlfnlf.sys
1998-03-20 01:00 1,048 a--sh--- c:\windows\system32\TMail3FL.SYS
1998-03-20 01:00 1,048 a--sh--- c:\windows\system32\TMailRL.sys

============= FINISH: 5:33:28.75 ===============

Regards

Dene

Hi ridgedale,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.

Please give me a little time to go through your log and I will get back to you with your first instructions. Don't worry I won't abandon you.

• Please subscribe to this topic, if you haven't already, and wait for me to get back to you.
  
  
• Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
  
  
• Please reply to this post so I know you are there.

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day then I will close the topic.

Thanks

No problem, m0le. I'll be waiting ready. Sorry, I've been a bit slow on the uptake today - a bit snowed under.
Is there any chance you can let me know roughly in what time frame you will be responding to my input and what time zone you are in? It might help me respond quicker although I will respond definitely within 12-24 hours if not sooner.

Regards

Dene

ridgedale, on May 27 2009, 05:29 PM, said:

Hi ridgedale,

I will aim to respond within 24 hours. I'm in GMT as I'm from the UK.

I won't close you off without bumping the topic and PMing you so don't worry.

Back later with some instructions

Hi again,

Your log is clean but what you do have is Kaspersky flagging two types of thing.

The first flag is for Thunderbird email folder items. These can be removed by emptying the folders.
For example, this entry below can be removed by emptying your inbox.

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox.sbd\Spam Infected: Trojan-Downloader.Win32.Exchanger.agc 1

If you don't want to do that then you would need to remove any emails in your inbox with an attachment.

The second set of entries are like this:

C:\Program Files\RealVNC\VNC4\wm_hooks.dll/C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4

The files are legitimate but are flagged because they perform certain tasks which are also used by malware.

Please delete the Thunderbird emails and then rerun the Kaspersky scan so we can check.

m0le,

This is going to take a while as I am going to have to divide the the contents of the affected mailbox folders until I can ascertain which emails are infected - I'm intending to 'slice and dice' the mail folders until I can establish the infected emails and deal with them individually which I have already started doing. I've cleared out all the obvious stuff and the VNC not malware flags have now gone as you will be able to see from the latest Kaspersky Online Scan below:

=============================== Kaspersky Online Scan Log ===============================

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Thursday, May 28, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, May 28, 2009 05:39:50
Records in database: 2262729
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Folder:
C:\Documents and Settings

Scan statistics:
Files scanned: 6239
Threat name: 5
Infected objects: 6
Suspicious objects: 20
Duration of the scan: 00:18:15


File name / Threat name / Threats count
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 18
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Email-Worm.Win32.Agent.ev 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.HTML.Halifraud.e 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox.sbd\Ian Infected: Trojan.Win32.Agent2.bl 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox.sbd\Ian.sbd\Sent to Ian Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Infected: Trojan.Win32.Agent2.bl 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent-Jan3109 Infected: Trojan.Win32.Agent2.bl 1

The selected area was scanned.

=============================== End of Scan Log ===============================

I will get back to you as soon as I have managed to generate a clean scan.

Thanks for your assistance.

Regards

Dene

m0le,

Apologies, please ignore the comments regarding the VNC non-malware hits and the log provided in my earlier post as I realised I was logged in as the user rather than the administrator. Below is is the latest Kaspersky Log:

=================================== Kaspersky Online Scanner Log ===================================

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Thursday, May 28, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, May 28, 2009 05:39:50
Records in database: 2262729
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Folder:
C:\Documents and Settings

Scan statistics:
Files scanned: 10516
Threat name: 34
Infected objects: 41
Suspicious objects: 21
Duration of the scan: 01:16:26


File name / Threat name / Threats count
C:\Documents and Settings\Gemma\My Documents\Installers\vnc-4_1_2-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 4
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 18
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Email-Worm.Win32.Agent.ev 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.HTML.Halifraud.e 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dip 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dkf 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dqu 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dvy 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dwr 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dxc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dyx 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ebd 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan.Win32.Crypt.lf 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ech 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.edp 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.lsv 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.efo 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.lua 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ehs 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.luy 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ejy 2
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.lxg 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.eks 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.lyo 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.enm 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.emq 2
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.mdc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.eod 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.mjk 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ero 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.mtw 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox.sbd\Ian Infected: Trojan.Win32.Agent2.bl 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox.sbd\Ian.sbd\Sent to Ian Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Infected: Trojan.Win32.Agent2.bl 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent-Jan3109 Infected: Trojan.Win32.Agent2.bl 1
C:\Documents and Settings\Ian B Murray\Application Data\Thunderbird\Profiles\ahv06gf0.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.HTML.Bankfraud.od 2
C:\Documents and Settings\Ian B Murray\Application Data\Thunderbird\Profiles\ahv06gf0.default\Mail\Local Folders\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 1

The selected area was scanned.

=================================== End Of Log ===================================

As you can see, although I have removed the SPAM folder and emptied the Trash that action appears to have reinfected/uncovered infections directly in the Inbox.
I will continue with the intended procedure as mentioned in my previous post.

Regards

Dene

Okay, let me know if you are having problems with that.

Hi ridgedale,

How is the Thunderbird clearout going?

m0le,

Thanks or your patience and apologies for the delay in getting back to you. This has taken some time so far. I'll explain what I have done so far.

I've removed any redundant accounts from the computer - now left with the main user account and the admin account.

I logged into the main user account, launched Thunderbird and immediately set the mail client to work offline.

Then I sliced and diced the contents of the mailbox until I had removed all the mailbox infections in this user account - carrying out Kaspersky Online Scans each time I completed a chunk of the work.

I moved everything out of both the Inbox and Sent mailboxes and even deleted the Inbox altogether and restarted Thunderbird so it rebuilt the Inbox on relaunch. I rescanned the whole mailbox to confirm it was clean.

Then as a final check I logged back into the admin account and ran a full system scan - I surprised to find that the admin account still sees infections related to the user mailbox - see below!

============================== Kaspersky Online Full System Scan ============================

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Monday, June 1, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Monday, June 01, 2009 08:41:31
Records in database: 2289664
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\

Scan statistics:
Files scanned: 48631
Threat name: 5
Infected objects: 30
Suspicious objects: 11
Duration of the scan: 02:26:38


File name / Threat name / Threats count
C:\Program Files\RealVNC\VNC4\wm_hooks.dll/C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 18
C:\Program Files\RealVNC\VNC4\WinVNC4.exe/C:\Program Files\RealVNC\VNC4\WinVNC4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Documents and Settings\Gemma\My Documents\Installers\vnc-4_1_2-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 4
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 10
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Email-Worm.Win32.Agent.ev 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\MCA_Mail.sbd\Ian Infected: Trojan.Win32.Agent2.bl 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Infected: Trojan.Win32.Agent2.bl 1
C:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1

The selected area was scanned.

================================== End of Scan Log ================================

The VNC not-a-virus flags are not an issue, however any thoughts on how I should proceed to resolve the remainder of the infections would be appreciated.

Regards

Dene

Hi ridgedale,

This Thunderbird profile is the problem, sm0j38r3.default. You have done a great job with the other profile: ahv06gf0.default which now doesn't come up on the Kaspersky scan.

If you are no longer using this profile then delete it and rescan.

If you don't wish to delete this profile then switch profiles and then access the folders to delete the emails there.

m0le,

Thanks for your feedback again. The non-admin user holds the all the mail for an important account which it would be best to try to salvage as much of the email, if not all, as possible. The machine has not been used since I carried out the last round of remedial work mentioned previously and running the Kaspersky Online Scanner under the machine's Admin account.

What I have since done is log into the normal user account and rerun the Kaspersky Online Scanner - remember this is the first time the machine has been logged onto since I ran the last scan - I couldn't believe the results of the log:

===================== First Kaspersky Online Scanner Log Run from User Account Today ====================

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Tuesday, June 2, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Tuesday, June 02, 2009 10:28:21
Records in database: 2295588
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\

Scan statistics:
Files scanned: 38015
Threat name: 50
Infected objects: 67
Suspicious objects: 21
Duration of the scan: 01:02:33


File name / Threat name / Threats count
C:\Program Files\RealVNC\VNC4\wm_hooks.dll/C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 12
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 20
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Email-Worm.Win32.Agent.ev 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.HTML.Halifraud.e 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dip 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dkf 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dqu 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dvy 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dwr 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dxc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.dyx 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ebd 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan.Win32.Crypt.lf 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ech 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.edp 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.lsv 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.efo 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.lua 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ehs 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.luy 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ejy 2
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.lxg 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.eks 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.lyo 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.enm 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.emq 2
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.mdc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.eod 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.mjk 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.ero 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.mtw 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan.Win32.FraudPack.gen 2
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.mwb 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.etl 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Spy.Win32.Zbot.euc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.ngp 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.nox 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan.Win32.Agent.adyf 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan.Win32.Monderb.rov 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Downloader.Win32.Exchanger.agc 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Email-Worm.Win32.Druzgl.b 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan.Win32.Agent.agth 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan.Win32.Pakes.leq 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Mailfinder.Win32.Agent.vf 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan.Win32.Pakes.lin 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan.Win32.Agent.akoq 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Worm.Win32.AutoRun.rkt 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox Infected: Trojan-Downloader.Win32.Agent.ankd 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\MCA_Mail.sbd\Ian Infected: Trojan.Win32.Agent2.bl 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Infected: Trojan.Win32.Agent2.bl 1
C:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1

The selected area was scanned.

========================================== END OF LOG =========================================

The infection appears to be self-fuelling?! I then as a first step moved all the email out of the Inbox as chunks into subdirectories under Mail\Local Folders\INBOXctrl and this seems to have eradicated the problems in the Inbox - or they just not getting picked up?


===================== Second Kaspersky Online Scanner Log Run from User Account Today ====================

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Tuesday, June 2, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Tuesday, June 02, 2009 13:24:25
Records in database: 2296262
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\

Scan statistics:
Files scanned: 38014
Threat name: 3
Infected objects: 19
Suspicious objects: 1
Duration of the scan: 01:52:52


File name / Threat name / Threats count
C:\Program Files\RealVNC\VNC4\wm_hooks.dll/C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 14
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\INBOXctrl-RCL.sbd\Ian Infected: Trojan.Win32.Agent2.bl 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent Infected: Trojan.Win32.Agent2.bl 1
C:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1

The selected area was scanned.

========================================== END OF LOG =========================================

I am wondering if it might be worth trying one of the other free anti-virus products (Avast! / Avira / AVG / Comodo / PC Tools to see if they could help clean up the infections or possible detect the individual emails causing the problems (- probably not if the contents of a folder are just a single mbox file?)! Or are they all just prevention tools?

Any thoughts would be appreciated.

Regards

Dene

This could be a major problem as the profile seems to be very infected.

However, let's err on the side of caution and try another scanner and see what that picks up.

Please run a BitDefender Online Scan

• Click I Agree to agree to the EULA.
  
• Allow the ActiveX control to install when prompted.
  
• Click Click here to scan to begin the scan.
  
• Please refrain from using the computer until the scan is finished. This might take a while to run, but it is important that nothing else is running while you scan.
  
• When the scan is finished, click on Click here to export the scan results.
  
• Save the report to your desktop so you can post it in your next reply.

Should be interesting...

m0le,

I am a little concerned that BitDefender reported that it was to scan in excess of 55,000 files but in the end only scanned about 22,000+! I thought about running the BitDefender Online Scan again from within the User account given the variances experienced with the Kaspersky Online Scanner but have only ran it fro within the admin account. Below is a copy of the exported BitDefender Scan results as requested:

================================BitDefender Scan Log===================================

BitDefender Online Scanner

Scan report generated at: Wed, Jun 03, 2009 - 11:14:45

Scan path: A:\;C:\;D:\;

Statistics

Time

01:00:01

Files

223517

Folders

6620

Boot Sectors

0

Archives

28520

Packed Files

10727


Results

Identified Viruses

50

Infected Files

56

Suspect Files

0

Warnings

0

Disinfected

0

Deleted Files

56


Engines Info

Virus Definitions

3290783

Engine build

AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)

Scan plugins

17

Archive plugins

45

Unpack plugins

7

E-mail plugins

6

System plugins

4


Scan Settings

First Action

Disinfect

Second Action

Delete

Heuristics

Yes

Enable Warnings

Yes

Scanned Extensions

*;

Exclude Extensions



Scan Emails

Yes

Scan Archives

Yes

Scan Packed

Yes

Scan Files

Yes

Scan Boot

Yes


Scanned File

Status

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1030)=>[Subject: Hot pictures][Date: Fri, 25 Jan 2008 12:32:57 -0500]=>(MIME part)=>video.zip=>video.scr


Infected with: Trojan.Pandex.G

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1030)=>[Subject: Hot pictures][Date: Fri, 25 Jan 2008 12:32:57 -0500]=>(MIME part)=>video.zip=>video.scr


Disinfection failed

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1030)=>[Subject: Hot pictures][Date: Fri, 25 Jan 2008 12:32:57 -0500]=>(MIME part)=>video.zip=>video.scr


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1030)=>[Subject: Hot pictures][Date: Fri, 25 Jan 2008 12:32:57 -0500]=>(MIME part)=>video.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1030)=>[Subject: Hot pictures][Date: Fri, 25 Jan 2008 12:32:57 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1030)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1952)=>[Subject: Hot pictures][Date:?Sun, 27 Apr 2008 11:46:01 +0800]=>(MIME part)=>saver.zip=>saver.exe


Infected with: Trojan.Generic.1627649

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1952)=>[Subject: Hot pictures][Date:?Sun, 27 Apr 2008 11:46:01 +0800]=>(MIME part)=>saver.zip=>saver.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1952)=>[Subject: Hot pictures][Date:?Sun, 27 Apr 2008 11:46:01 +0800]=>(MIME part)=>saver.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1952)=>[Subject: Hot pictures][Date:?Sun, 27 Apr 2008 11:46:01 +0800]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 1952)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2895)=>[Subject: UPS Tracking Number 8829304601][Date: Mon, 21 Jul 2008 19:10:30 -0500]=>(MIME part)=>UPS_INVOICE_978172.zip=>UPS_INVOIC奨㗴솺닕໢ꘌꓔ࿜á�‘ìš¿ë¥ºê© áƒœã�³ê�Œèž—ç®›âŠ‘î– ç§…èº�è¿¢ç“¼â´¨ì§ŠåŒƒéŒ‹ç’°í°›å‚‘å˜›æ‚´ê ’ë»‡êº‡ê œã‹‚ê…�舆㘗◱棙ᶑ庨î�›ç£¦ìˆŠì„ªãƒ 蹢䊜æ�—è²´â� ྄äˆ�é—�áªŠí¦¢î‚Žá«§ê–„å‘°ä›ˆè‚Ÿã¹‡â��ӛ簱내â¿�ㄳ㤼îƒ�伬伽쮿胚툿ﲱëž�啡ฟè™�䚺〴â¸�ï©¿á‘€é€�ꮇ㊡䣗è�µå•…賤ᮒ섑₧蕊졪é�½é�‘ï»Šâ¤¹è£œí»–ã�¹è¶šî¦Ÿé¾ƒé»¨ï ц勽腷ꭘ縇鯡ឣ䬾뀖ր怬à¬�ì�˜á˜‚è‚°â°…Å å ‹Ë€ï€–à¿¿ã±Œå„€ä¹�㥀î”�é�šåƒ‡ìƒ¾ì¿�î�›ë‹¿äƒ­ï±µç’¿æ¿³ä£½âµŠë¸¹ê¹´å–¯á�°â›—ï‡�쀽%陹쿨ä�½Í§ïƒ»ç³¯â’¹à©‹îƒ§çƒ®â� Ü�â²–ã™¿ã ±ì œç¼¸î�¶ä‹°ç¾˜Þ®à½¡è�¶éµ³ì�½á’¹ç�žì¹¶í¹­ã‹†áƒ¸ìº›ïŸµï¥¡â²’ä‡�ﾆ趦᧫ï�¬ï¡—벌ã�˜á‡¼ç¿„è ¿ï�½å�¿ã�™î‡³ë¡¡æ·šì©œç­ší·«î¼»ë¹•ç¹�왉묥䢧뛉掤縞痤á“�í²…î±³è¹�å�®ä„™â›–䦜斞í�žî‹žï³ƒì¹£ä�ƒî›²áœ”é©»á¿©í“›æŸ¼á¾¬ã¸¿ê£²í¼–ë‰ƒå¯—ì†µìŠ¨ç¶¹Infected with: Trojan.Spy.Wsnpoem.EF


Infected with: Trojan.Spy.Wsnpoem.EF

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2895)=>[Subject: UPS Tracking Number 8829304601][Date: Mon, 21 Jul 2008 19:10:30 -0500]=>(MIME part)=>UPS_INVOICE_978172.zip=>UPS_INVOICS_INVOIC奨㗴솺닕໢ꘌꓔ࿜á�‘ìš¿ë¥ºê© áƒœã�³ê�Œèž—ç®›âŠ‘î– ç§…èº�è¿¢ç“¼â´¨ì§ŠåŒƒéŒ‹ç’°í°›å‚‘å˜›æ‚´ê ’ë»‡êº‡ê œã‹‚ê…�舆㘗◱棙ᶑ庨î�›ç£¦ìˆŠì„ªãƒ 蹢䊜æ�—è²´â� ྄äˆ�é—�áªŠí¦¢î‚Žá«§ê–„å‘°ä›ˆè‚Ÿã¹‡â��ӛ簱내â¿�ㄳ㤼îƒ�伬伽쮿胚툿ﲱëž�啡ฟè™�䚺〴â¸�ï©¿á‘€é€�ꮇ㊡䣗è�µå•…賤ᮒ섑₧蕊졪é�½é�‘ï»Šâ¤¹è£œí»–ã�¹è¶šî¦Ÿé¾ƒé»¨ï ц勽腷ꭘ縇鯡ឣ䬾뀖ր怬à¬�ì�˜á˜‚è‚°â°…Å å ‹Ë€ï€–à¿¿ã±Œå„€ä¹�㥀î”�é�šåƒ‡ìƒ¾ì¿�î�›ë‹¿äƒ­ï±µç’¿æ¿³ä£½âµŠë¸¹ê¹´å–¯á�°â›—ï‡�쀽%陹쿨ä�½Í§ïƒ»ç³¯â’¹à©‹îƒ§çƒ®â� Ü�â²–ã™¿ã ±ì œç¼¸î�¶ä‹°ç¾˜Þ®à½¡è�¶éµ³ì�½á’¹ç�žì¹¶í¹­ã‹†áƒ¸ìº›ïŸµï¥¡â²’ä‡�ﾆ趦᧫ï�¬ï¡—벌ã�˜á‡¼ç¿„è ¿ï�½å�¿ã�™î‡³ë¡¡æ·šì©œç­ší·«î¼»ë¹•ç¹�왉묥䢧뛉掤縞痤á“�í²…î±³è¹�å�®ä„™â›–䦜斞í�žî‹žï³ƒì¹£ä�ƒî›²áœ”驻Ῡ퓛æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2895)=>[Subject: UPS Tracking Number 8829304601][Date: Mon, 21 Jul 2008 19:10:30 -0500]=>(MIME part)=>UPS_INVOICE_978172.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2895)=>[Subject: UPS Tracking Number 8829304601][Date: Mon, 21 Jul 2008 19:10:30 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2895)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2925)=>[Subject: UPS Tracking Number 3279256499][Date: Wed, 23 Jul 2008 20:05:18 -0500]=>(MIME part)=>invoice_8712.zip=>INVOICE_8712.exeà¶§ê‡Œä±˜í°©á�§å­ƒä¬²î‡�á²‚í¥„ã¢½ç¬œç·¡ã€„î³‰ï �癃ㆸê˜�஼êž�ދቇᢼ퓭鼚אָ楜ì�£ç�¶çƒ»Ø¼á�“쒕銌ﾉ㡄綇é¢�狆溌烚혪ꢗ㇛Ἱ௄④甘陴猜猇à·�êŒ§è‡®æ–«Ð”í¤ è§™ì�‰å¯ºì�˜äž çµ¢ä›žæ…£æ‘ºä„«ÚŸë§‚â £ã¹¸è…¶ç—±æˆ±ï¹´è±¼ê´¤é”—å©°èŒ â¡¶ì¡›â¥¢ìŠ®í¬–Ä®ì�­æ¹œï³�袙氅ë� 䲘氷悽í�¡à³�ퟜ봹๿앳완챒㟯濌꘩扦ï�›äœŸî§±çŽƒç’®åŠŽä«¿ç¬¤â¼—á¯¾ë„—ä–ˆæˆ¬è¬‘ì‘˜á˜¢è¢±â±…á…¢å¢‹â‹„ã¿¾äª€ã ‚î¢‚êˆ‚è ›âƒ®ä�Šäµ”뫺乮쯺ζ䦓廿➜ï��䟻ۛïœ�è”�ê‰�鑉瞿뾴䑉ꑘ瑷ä¾�뾨঩긄ꄦé…�ᇆꇇ熧ïŠ�㕿ึຊ軳튄彽気ì�½ìˆ­è‹½ï²¢ê�½è“¡ïˆ„ã”³á€¹æ •á±¶ï´‚ëš‚æ­©è—¹Ê†ã˜¤æµŒê­�统芜柬î�°å—„覷잊嫜빎░㲮鋦쥮å¸�녕┻ﴣ⼵ç²�瘷壯ã�°î»³ç§ºíª«è¾œè¸�圥닋ê¥�ì†�ë²¥ì¤¬æ¹ºä¯Ÿç’«ïƒ†í«‰ã®�矧㴹â¼�í»¦ï¥Šâ»£ç†¥æ¼»ç«¢æµ°à·†ê±žÆ¢æ­±ç°�ë‹¯æ‰“î«¯í¥²éµ’Infected with: Trojan.Spy.Wsnpoem.EJ


Infected with: Trojan.Spy.Wsnpoem.EJ

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2925)=>[Subject: UPS Tracking Number 3279256499][Date: Wed, 23 Jul 2008 20:05:18 -0500]=>(MIME part)=>invoice_8712.zip=>INVOICE_8712.exe8712.exeà¶§ê‡Œä±˜í°©á�§å­ƒä¬²î‡�á²‚í¥„ã¢½ç¬œç·¡ã€„î³‰ï �癃ㆸê˜�஼êž�ދቇᢼ퓭鼚אָ楜ì�£ç�¶çƒ»Ø¼á�“쒕銌ﾉ㡄綇é¢�狆溌烚혪ꢗ㇛Ἱ௄④甘陴猜猇à·�êŒ§è‡®æ–«Ð”í¤ è§™ì�‰å¯ºì�˜äž çµ¢ä›žæ…£æ‘ºä„«ÚŸë§‚â £ã¹¸è…¶ç—±æˆ±ï¹´è±¼ê´¤é”—å©°èŒ â¡¶ì¡›â¥¢ìŠ®í¬–Ä®ì�­æ¹œï³�袙氅ë� 䲘氷悽í�¡à³�ퟜ봹๿앳완챒㟯濌꘩扦ï�›äœŸî§±çŽƒç’®åŠŽä«¿ç¬¤â¼—á¯¾ë„—ä–ˆæˆ¬è¬‘ì‘˜á˜¢è¢±â±…á…¢å¢‹â‹„ã¿¾äª€ã ‚î¢‚êˆ‚è ›âƒ®ä�Šäµ”뫺乮쯺ζ䦓廿➜ï��䟻ۛïœ�è”�ê‰�鑉瞿뾴䑉ꑘ瑷ä¾�뾨঩긄ꄦé…�ᇆꇇ熧ïŠ�㕿ึຊ軳튄彽気ì�½ìˆ­è‹½ï²¢ê�½è“¡ïˆ„ã”³á€¹æ •á±¶ï´‚ëš‚æ­©è—¹Ê†ã˜¤æµŒê­�统芜柬î�°å—„覷잊嫜빎░㲮鋦쥮å¸�녕┻ﴣ⼵ç²�瘷壯ã�°î»³ç§ºíª«è¾œè¸�圥닋ê¥�ì†�ë²¥ì¤¬æ¹ºä¯Ÿç’«ïƒ†í«‰ã®�矧㴹â¼�í»¦ï¥Šâ»£ç†¥æ¼»ç«¢æµ°æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2925)=>[Subject: UPS Tracking Number 3279256499][Date: Wed, 23 Jul 2008 20:05:18 -0500]=>(MIME part)=>invoice_8712.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2925)=>[Subject: UPS Tracking Number 3279256499][Date: Wed, 23 Jul 2008 20:05:18 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 2925)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3032)=>[Subject: UPS INVOICE 1001918617][Date: Mon, 4 Aug 2008 13:29:52 -0600]=>(MIME part)=>RESU8192.zip=>RESU8192.exe


Infected with: Trojan.Agent.AJLI

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3032)=>[Subject: UPS INVOICE 1001918617][Date: Mon, 4 Aug 2008 13:29:52 -0600]=>(MIME part)=>RESU8192.zip=>RESU8192.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3032)=>[Subject: UPS INVOICE 1001918617][Date: Mon, 4 Aug 2008 13:29:52 -0600]=>(MIME part)=>RESU8192.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3032)=>[Subject: UPS INVOICE 1001918617][Date: Mon, 4 Aug 2008 13:29:52 -0600]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3032)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3102)=>[Subject: Tracking N 6713426110][Date: Tue, 12 Aug 2008 10:52:22 +0800]=>(MIME part)=>WW_671282.zip=>WW_671282.exe


Infected with: Trojan.Spy.Wsnpoem.GH

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3102)=>[Subject: Tracking N 6713426110][Date: Tue, 12 Aug 2008 10:52:22 +0800]=>(MIME part)=>WW_671282.zip=>WW_671282.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3102)=>[Subject: Tracking N 6713426110][Date: Tue, 12 Aug 2008 10:52:22 +0800]=>(MIME part)=>WW_671282.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3102)=>[Subject: Tracking N 6713426110][Date: Tue, 12 Aug 2008 10:52:22 +0800]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3102)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3121)=>[Subject: Tracking N_ 2356503447][Date: Tue, 12 Aug 2008 23:35:30 -0700]=>(MIME part)=>WW2_ASH182.zip=>WW2_ASH182.exe


Infected with: Trojan.Agent.AJOS

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3121)=>[Subject: Tracking N_ 2356503447][Date: Tue, 12 Aug 2008 23:35:30 -0700]=>(MIME part)=>WW2_ASH182.zip=>WW2_ASH182.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3121)=>[Subject: Tracking N_ 2356503447][Date: Tue, 12 Aug 2008 23:35:30 -0700]=>(MIME part)=>WW2_ASH182.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3121)=>[Subject: Tracking N_ 2356503447][Date: Tue, 12 Aug 2008 23:35:30 -0700]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3121)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3132)=>[Subject: Tracking N 7542418285][Date: Wed, 13 Aug 2008 08:39:59 -0500]=>(MIME part)=>MB_8712.zip=>MB_8712.exe


Infected with: Trojan.Spy.ZBot.JD

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3132)=>[Subject: Tracking N 7542418285][Date: Wed, 13 Aug 2008 08:39:59 -0500]=>(MIME part)=>MB_8712.zip=>MB_8712.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3132)=>[Subject: Tracking N 7542418285][Date: Wed, 13 Aug 2008 08:39:59 -0500]=>(MIME part)=>MB_8712.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3132)=>[Subject: Tracking N 7542418285][Date: Wed, 13 Aug 2008 08:39:59 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3132)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3156)=>[Subject: Auto Identification Card][Date:?Fri, 15 Aug 2008 07:42:51 +0000]=>(MIME part)=>ID76291.zip=>ID76291.exe


Infected with: Trojan.FakeAlert.Gen.1

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3156)=>[Subject: Auto Identification Card][Date:?Fri, 15 Aug 2008 07:42:51 +0000]=>(MIME part)=>ID76291.zip=>ID76291.exe


Disinfection failed

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3156)=>[Subject: Auto Identification Card][Date:?Fri, 15 Aug 2008 07:42:51 +0000]=>(MIME part)=>ID76291.zip=>ID76291.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3156)=>[Subject: Auto Identification Card][Date:?Fri, 15 Aug 2008 07:42:51 +0000]=>(MIME part)=>ID76291.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3156)=>[Subject: Auto Identification Card][Date:?Fri, 15 Aug 2008 07:42:51 +0000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3156)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3165)=>[Subject: Tracking N 2254642284][Date: Sun, 17 Aug 2008 11:15:17 +0000]=>(MIME part)=>fedex_m8712.zip=>fedex_m8712.exe


Infected with: Trojan.Spy.Wsnpoem.GS

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3165)=>[Subject: Tracking N 2254642284][Date: Sun, 17 Aug 2008 11:15:17 +0000]=>(MIME part)=>fedex_m8712.zip=>fedex_m8712.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3165)=>[Subject: Tracking N 2254642284][Date: Sun, 17 Aug 2008 11:15:17 +0000]=>(MIME part)=>fedex_m8712.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3165)=>[Subject: Tracking N 2254642284][Date: Sun, 17 Aug 2008 11:15:17 +0000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3165)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3167)=>[Subject: Your Flight Ticket N2040674][Date: Mon, 18 Aug 2008 07:49:50 +0100]=>(MIME part)=>Ticket_N141-SK.zip=>Ticket_N141-SK.eâº�至é �ᡟ㺌旆갦弴榞᫬효â›�ዬê�‚ç­�뀀䈇頻ä�€ê¨ƒã»¸ë� ඲ï¡�é µà¼°çƒµå¡˜ã½¯è�´ì¶�⹷ߢ蓾ã¼�ì�¾á®�椑âŠ�ꈋä™�ꆷ簪㉗↵퀢ਲ਼笕盬囖ç¶�ᨶ퓱毪耧꥙í�‡í›‡æ…ªá¾¤ê¼£è¯¾ï¥“鑿爾á¼�秩疂í±�æ§—ê¾¿è®¸í„“ä¹‰à¹Žã–ƒí’µí¬³â®¬ëž§à½ƒæ¦®é›¢á‚ çµ°í¹�á�€ä—§ëƒ´ì—·ç¥»åš²î˜°ì•²ç¸¢í½™ì€”æ¬²í¾Œë‘‡éˆ§æŒ¶ç´¼à«�î¯¿à¿ºåª—äœ¯çœ¿îš°ã©¹èŽºå—…ã½¯áŸžê¨®ë… ç……*﹗贮轡巾؂ã—�í‡šã¢‘ïŠ®å’—à¸®î¥ºëœºî Šâ¸”ê¹¹ê¾­çž¿Ö³à¿»æ�‘袰ïœ�á£®á­¬ë¥¯å‰”ë˜Œäƒ¢à±¢ç†–à«Œí ‹â‚µç±›á°·ï«�⺀^ï¹²ã¯­í¢±ï¼¬çƒŽâµ˜â„¾å¬†ä€«î·šà©Ÿî•‰â …ã‡³î’¨ã¡Ÿä†…à°ƒà§ŸáŒªï‡”ï··é¢©ì©±î šã¥Ÿá¾¡í®ˆÃ˜ç¯�í¨·â‚¡ì ¬æ©¢çž¾æ¶³âª¼îŽ‹áƒ¯ê”¾æ°‰êƒ±â¸‰ä�±àµ¥î¥�ã™¯â²µæ •ä¢¬È‡á¼Œâ™˜ë”½â§¬çž¬é˜‹ì‹…ï”²æ–©ë€•ß¬åŒ¬æ–…å�†á«‹ê¦€äžŠí»�塶褶嚥듀잎뀔∠销è�“⯉밃ࡢï¿�á«œë©�ß�âµ”í¸‡ä·¥ï­­ã£˜ãŽˆæ‹†ë•©ã˜Œï„„ã�·îŠ™å¨ˆâƒ­ç¹¸í†¥Infected with: Trojan.Downloader.Agent.ZOI


Infected with: Trojan.Downloader.Agent.ZOI

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3167)=>[Subject: Your Flight Ticket N2040674][Date: Mon, 18 Aug 2008 07:49:50 +0100]=>(MIME part)=>Ticket_N141-SK.zip=>Ticket_N141-SK.e141-SK.eâº�至é �ᡟ㺌旆갦弴榞᫬효â›�ዬê�‚ç­�뀀䈇頻ä�€ê¨ƒã»¸ë� ඲ï¡�é µà¼°çƒµå¡˜ã½¯è�´ì¶�⹷ߢ蓾ã¼�ì�¾á®�椑âŠ�ꈋä™�ꆷ簪㉗↵퀢ਲ਼笕盬囖ç¶�ᨶ퓱毪耧꥙í�‡í›‡æ…ªá¾¤ê¼£è¯¾ï¥“鑿爾á¼�秩疂í±�æ§—ê¾¿è®¸í„“ä¹‰à¹Žã–ƒí’µí¬³â®¬ëž§à½ƒæ¦®é›¢á‚ çµ°í¹�á�€ä—§ëƒ´ì—·ç¥»åš²î˜°ì•²ç¸¢í½™ì€”æ¬²í¾Œë‘‡éˆ§æŒ¶ç´¼à«�î¯¿à¿ºåª—äœ¯çœ¿îš°ã©¹èŽºå—…ã½¯áŸžê¨®ë… ç……*﹗贮轡巾؂ã—�í‡šã¢‘ïŠ®å’—à¸®î¥ºëœºî Šâ¸”ê¹¹ê¾­çž¿Ö³à¿»æ�‘袰ïœ�á£®á­¬ë¥¯å‰”ë˜Œäƒ¢à±¢ç†–à«Œí ‹â‚µç±›á°·ï«�⺀^ï¹²ã¯­í¢±ï¼¬çƒŽâµ˜â„¾å¬†ä€«î·šà©Ÿî•‰â …ã‡³î’¨ã¡Ÿä†…à°ƒà§ŸáŒªï‡”ï··é¢©ì©±î šã¥Ÿá¾¡í®ˆÃ˜ç¯�í¨·â‚¡ì ¬æ©¢çž¾æ¶³âª¼îŽ‹áƒ¯ê”¾æ°‰êƒ±â¸‰ä�±àµ¥î¥�ã™¯â²µæ •ä¢¬È‡á¼Œâ™˜ë”½â§¬çž¬é˜‹ì‹…ï”²æ–©ë€•ß¬åŒ¬æ–…å�†á«‹ê¦€äžŠí»�塶褶嚥듀잎뀔∠销è�“⯉밃ࡢï¿�á«œë©�ß�âµ”í¸‡ä·¥ï­­ã£˜ãŽˆæ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3167)=>[Subject: Your Flight Ticket N2040674][Date: Mon, 18 Aug 2008 07:49:50 +0100]=>(MIME part)=>Ticket_N141-SK.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3167)=>[Subject: Your Flight Ticket N2040674][Date: Mon, 18 Aug 2008 07:49:50 +0100]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3167)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3180)=>[Subject: TRACKING NUMBER 8315198236][Date: Mon, 18 Aug 2008 15:57:59 -0500]=>(MIME part)=>Exel_Invoice_NR719200.zip=>Exel_InvoièŠ²ç®‹ê†¥å“¡ä›°í½¤è–£é± ì¦Ší�«ê¯�㥙翴࡭荒ᤚè�ˆæ¡¬èº§îŸ”뼚䤞顅ᨬ졂ë¼�襈ïŠ�㫣娣힂䨞æ�¨à¤§ë’¹íšŸâ˜¢ê”¬îŸºï‹¿ç�…岞戫ꓭ㘧ঢ尟ï‰�ì�¯æ¨–æ�¨ä¿¼îºžæ‹©á†¿ä�ºîŠŒážƒè’°ã˜¯äˆ­ç»’íª†âŒªç¬˜î¬ªä¨—á¬—á¿³ï�¡á£‚ë™�ã˜�℔뽣ﷲ钞혮삇è­�꓀弽홵ä�·ê¡¬í”§ïª¨äŸ·ì°¢å®—스ìˆ�郤䵮ï�–橅桨￘麓ሌ륶示扪蚊뉮ì�´ì¢Œá‰“î¥½è³¸áƒŠí½‚é‰¿åˆ¨â�¹ç·¬æµ„篩è�™í—§îŸ™îƒ»á½‰ã†´î¿¿á™�é™¾ä® â��ꡨ잤챦豌壴䱄è�•Ô¨ä��ê§»ä£˜í£±î‚´ç¿–æˆ¦ç©‡à¤Žà´¨å�¢á‰©í¥£ãº„裟쎱㼄ã½�╟㖬徉㿘⇿Ⴎ襪決翭Ԉ﵂ï¢�䄶颹ꑾ鬇濷꼧ã¶�ç³½í¿­ç¯·æ—ºè„¨ä¶Žä¿‹ç·ƒí€£ì¿˜è¨„ìŸ é†…â¿“à§™æ±�ꄼ駂ê¨�Ú‚í„¬áŸ©è‘™ìŒ–í°¯ã¶¿ê°©ë•�驡₢ശè‹�ⵞ㮼à´�æ‘�å�©à£—ￆ̭ꂳ㉃é�‚ï¸ƒè’“ï± ï¾³ç’Œî°ºé‹Ÿî¤œé‡�蟼무㭽ႉѾ᯶ẑâ­�é£¢å±€íµ¨ã›Œé·ƒï §ì¡ƒç„¥î§Ÿï¾—ë•¶â±—ë¼„à¦”ê‡¹æ¯¯Infected with: Trojan.Spy.Wsnpoem.GV


Infected with: Trojan.Spy.Wsnpoem.GV

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3180)=>[Subject: TRACKING NUMBER 8315198236][Date: Mon, 18 Aug 2008 15:57:59 -0500]=>(MIME part)=>Exel_Invoice_NR719200.zip=>Exel_Invoiel_InvoièŠ²ç®‹ê†¥å“¡ä›°í½¤è–£é± ì¦Ší�«ê¯�㥙翴࡭荒ᤚè�ˆæ¡¬èº§îŸ”뼚䤞顅ᨬ졂ë¼�襈ïŠ�㫣娣힂䨞æ�¨à¤§ë’¹íšŸâ˜¢ê”¬îŸºï‹¿ç�…岞戫ꓭ㘧ঢ尟ï‰�ì�¯æ¨–æ�¨ä¿¼îºžæ‹©á†¿ä�ºîŠŒážƒè’°ã˜¯äˆ­ç»’íª†âŒªç¬˜î¬ªä¨—á¬—á¿³ï�¡á£‚ë™�ã˜�℔뽣ﷲ钞혮삇è­�꓀弽홵ä�·ê¡¬í”§ïª¨äŸ·ì°¢å®—스ìˆ�郤䵮ï�–橅桨￘麓ሌ륶示扪蚊뉮ì�´ì¢Œá‰“î¥½è³¸áƒŠí½‚é‰¿åˆ¨â�¹ç·¬æµ„篩è�™í—§îŸ™îƒ»á½‰ã†´î¿¿á™�é™¾ä® â��ꡨ잤챦豌壴䱄è�•Ô¨ä��ê§»ä£˜í£±î‚´ç¿–æˆ¦ç©‡à¤Žà´¨å�¢á‰©í¥£ãº„裟쎱㼄ã½�╟㖬徉㿘⇿Ⴎ襪決翭Ԉ﵂ï¢�䄶颹ꑾ鬇濷꼧ã¶�ç³½í¿­ç¯·æ—ºè„¨ä¶Žä¿‹ç·ƒí€£ì¿˜è¨„ìŸ é†…â¿“à§™æ±�ꄼ駂ê¨�Ú‚í„¬áŸ©è‘™ìŒ–í°¯ã¶¿ê°©ë•�驡₢ശè‹�ⵞ㮼à´�æ‘�å�©à£—ￆ̭ꂳ㉃é�‚ï¸ƒè’“ï± ï¾³ç’Œî°ºé‹Ÿî¤œé‡�蟼무㭽ႉѾ᯶ẑâ­�é£¢å±€íµ¨ã›Œé·ƒï §æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3180)=>[Subject: TRACKING NUMBER 8315198236][Date: Mon, 18 Aug 2008 15:57:59 -0500]=>(MIME part)=>Exel_Invoice_NR719200.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3180)=>[Subject: TRACKING NUMBER 8315198236][Date: Mon, 18 Aug 2008 15:57:59 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3180)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3197)=>[Subject: Fedex tracking number 4365996796][Date:?Wed, 20 Aug 2008 02:30:17 -0600]=>(MIME part)=>NFE6761525.zip=>NFE6761525.exe


Infected with: Trojan.Spy.Wsnpoem.GU

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3197)=>[Subject: Fedex tracking number 4365996796][Date:?Wed, 20 Aug 2008 02:30:17 -0600]=>(MIME part)=>NFE6761525.zip=>NFE6761525.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3197)=>[Subject: Fedex tracking number 4365996796][Date:?Wed, 20 Aug 2008 02:30:17 -0600]=>(MIME part)=>NFE6761525.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3197)=>[Subject: Fedex tracking number 4365996796][Date:?Wed, 20 Aug 2008 02:30:17 -0600]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3197)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3226)=>[Subject: Statement of fees 2008/09][Date:?Thu, 21 Aug 2008 23:39:11 -0500]=>(MIME part)=>Fees_2007-2008.zip=>Fees_2007-2008.doc.轰ⲕë��ä¥­ê“¼îŒªí§‹àªšìŠ¾íŠŒîµ®ä³§ã»¹ì¸¨ç‰¡îº…á­´å¶§ê§Ÿí‰–ê­´áœ»êªšë·ºå�¾ïµ¯í®�ꘪ븰㽷캕蜗磑ì�Ÿã¦·ïˆŽâ¦‚æ–Ÿâ¹ƒí¦Œê�•ç”µç»œà©¢é™£æ��î®³à´‹ç¨€ã›±å´´ã¡–ì¬ ï‰¾ê°°î™§â–�æ�¦íƒ¢ë¯—í›�戫擶éž�á½Žê²‡æžºä§¡æ±£Ã¼î €è“¦â”�㶔ᑨ퇮擦魼铸⚸脂鬅ᚇᵊ盛ç�´ì�´æŸ¶í¨´á¨˜à©¶æ‰¨ì‹¡èŒšèµ†Û§è©‡çœ°å¤µé–·ã¿�탯᥷á�ºë–»å¿•è¼¯î»»é¦Šà´ 㮸аザ㾣宩ѻ䎫昰ଶ繀æ�·ë��缕뮬˾㶈挚ê�Œá�˜è£‘嗇欉箃┴춹뿊ⅷ呇ã‘�îŽ¾ä²¸í›«ê•¸å¨ çŸ•é¨‹ã ‰ë�®ã·­á²Ÿí¶Œá˜�Ø�ᰌ磑ￚí�¢á‰¥ëœµå‘™é…�먡䃑籤覉힤å„�í¨½ê˜¹ë›©ï¼¦ê’�飗ꣵí�“â³·ï´£ì±�ç�ªí‘…⇣î��뻪경ᷞ꫟í¼�á·®äª·î ‚ë�¦ì¯¥å›¢å‡©î’°î”„᢭蘇踣슨å‘�禍–件執âˆ�⿚컹雂â›�í±žà½¢ä‘‘é¾´ëŠ‡ì½™í€¿î¹©à¿›ã€½í³°ã„ªå‹·í­„å½¥ëœ’éœ™ã–‰à •æ†œï¡…î®…í€´âš²ë�»é™»è´‚ⲉ鮄á•�뿪å€�昰Ꟁڃạ㶶俨謬哮趃Infected with: Trojan.Downloader.Agent.ZOP


Infected with: Trojan.Downloader.Agent.ZOP

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3226)=>[Subject: Statement of fees 2008/09][Date:?Thu, 21 Aug 2008 23:39:11 -0500]=>(MIME part)=>Fees_2007-2008.zip=>Fees_2007-2008.doc.008.doc.轰ⲕë��ä¥­ê“¼îŒªí§‹àªšìŠ¾íŠŒîµ®ä³§ã»¹ì¸¨ç‰¡îº…á­´å¶§ê§Ÿí‰–ê­´áœ»êªšë·ºå�¾ïµ¯í®�ꘪ븰㽷캕蜗磑ì�Ÿã¦·ïˆŽâ¦‚æ–Ÿâ¹ƒí¦Œê�•ç”µç»œà©¢é™£æ��î®³à´‹ç¨€ã›±å´´ã¡–ì¬ ï‰¾ê°°î™§â–�æ�¦íƒ¢ë¯—í›�戫擶éž�á½Žê²‡æžºä§¡æ±£Ã¼î €è“¦â”�㶔ᑨ퇮擦魼铸⚸脂鬅ᚇᵊ盛ç�´ì�´æŸ¶í¨´á¨˜à©¶æ‰¨ì‹¡èŒšèµ†Û§è©‡çœ°å¤µé–·ã¿�탯᥷á�ºë–»å¿•è¼¯î»»é¦Šà´ 㮸аザ㾣宩ѻ䎫昰ଶ繀æ�·ë��缕뮬˾㶈挚ê�Œá�˜è£‘嗇欉箃┴춹뿊ⅷ呇ã‘�îŽ¾ä²¸í›«ê•¸å¨ çŸ•é¨‹ã ‰ë�®ã·­á²Ÿí¶Œá˜�Ø�ᰌ磑ￚí�¢á‰¥ëœµå‘™é…�먡䃑籤覉힤å„�í¨½ê˜¹ë›©ï¼¦ê’�飗ꣵí�“â³·ï´£ì±�ç�ªí‘…⇣î��뻪경ᷞ꫟í¼�á·®äª·î ‚ë�¦ì¯¥å›¢å‡©î’°î”„᢭蘇踣슨å‘�禍–件執âˆ�⿚컹雂â›�í±žà½¢ä‘‘é¾´ëŠ‡ì½™í€¿î¹©à¿›ã€½í³°ã„ªå‹·í­„å½¥ëœ’éœ™ã–‰à •æ†œï¡…î®…í€´âš²ë�»é™»è´‚ⲉ鮄á•�뿪å€�æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3226)=>[Subject: Statement of fees 2008/09][Date:?Thu, 21 Aug 2008 23:39:11 -0500]=>(MIME part)=>Fees_2007-2008.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3226)=>[Subject: Statement of fees 2008/09][Date:?Thu, 21 Aug 2008 23:39:11 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3226)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3233)=>[Subject: Fedex tracking number 2947403134][Date: Fri, 22 Aug 2008 04:13:29 -0800]=>(MIME part)=>NNMA6766122.zip=>NNMA6766122.ex௎漵ꊤᒿ़羙ﻃ㨦₌힊ᵅ᳎톽è†�범䥃褘ំᩔ㓳⶧æ¯�çµ�ᛓꦨ骅航솿拏ã�›í¶¢×£æƒ´ï§¸Ï³ä®„ê�…뚴昑祼綠æŽ�é¸«æ”–èµºí¥¨ë–¬ì²•ç–±àº�è’«ç�žç£—癚䔼ç‰�ﱼí¡�ä¯šåº‚çˆ ëœ¾ï²–ä·®ä®ƒä’—âƒ«æ„™í¢¹ë®¢ï«†å¿¯î—›ë…«å»‡ê½€å¦“é¤…ë• å©¨ä¿—àµ ï”¸çŠ±á›¨î•·ãª­ã—¬í„„î­ î¬†å·©ê†¾î¾·âµ†í†›í¬»æ‰”çžœá‚®ä�¼á‹¿ç¡šè¦£æ ™âˆ�ì�§î¿¶á„„᧖掅á�«å˜•ë´™å™¸æ²˜ëƒ‹è–µáŸ�ꞎí·�䢌Ʈ俔暄憎隺⦣浺㽊䈪蓀濸뼌ﺡ뀞㖄ä…�æš´í¦ˆá¯ á¸ºì‡�ꕴ㙠ⷑ缔ٓ푆稱뛈î�µí¯„⨖ْ䊂巙ʬæ�ºã›�ﶂ斟ᣠኽ妆⽆낟㴹ä�¥ïˆ´è¬Ÿé‰¡á¡¯í¼³ç›ší´’ãŸ½ì§½æ‡®í€”è‹Ÿè»Œíƒ”âª¿é˜²êŠ¯ã»˜ì¸—ïš·ê€°í¡›áº…í°°á¯¤çŸºï¨”â’›í©Žà·´å…�歋ㄗ촡쑿ꎒ퀗嚲쟑嬶å��顙鷩ï�™äŸ²ê¹‚ê½‚à¾¾í¾”ä�Œé£·í µì˜¾á‡ˆà¬–à¹¡å…¨í¼–ç»†ê‰šâ°¼ç²¢áŒ‰ë¬®ì‹¼à´”è“„ç�™æµ¬â‚¡æ›„䤥趡뙋찿㪜糄溌뽉Infected with: Trojan.Spy.Wsnpoem.HH


Infected with: Trojan.Spy.Wsnpoem.HH

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3233)=>[Subject: Fedex tracking number 2947403134][Date: Fri, 22 Aug 2008 04:13:29 -0800]=>(MIME part)=>NNMA6766122.zip=>NNMA6766122.ex66122.ex௎漵ꊤᒿ़羙ﻃ㨦₌힊ᵅ᳎톽è†�범䥃褘ំᩔ㓳⶧æ¯�çµ�ᛓꦨ骅航솿拏ã�›í¶¢×£æƒ´ï§¸Ï³ä®„ê�…뚴昑祼綠æŽ�é¸«æ”–èµºí¥¨ë–¬ì²•ç–±àº�è’«ç�žç£—癚䔼ç‰�ﱼí¡�ä¯šåº‚çˆ ëœ¾ï²–ä·®ä®ƒä’—âƒ«æ„™í¢¹ë®¢ï«†å¿¯î—›ë…«å»‡ê½€å¦“é¤…ë• å©¨ä¿—àµ ï”¸çŠ±á›¨î•·ãª­ã—¬í„„î­ î¬†å·©ê†¾î¾·âµ†í†›í¬»æ‰”çžœá‚®ä�¼á‹¿ç¡šè¦£æ ™âˆ�ì�§î¿¶á„„᧖掅á�«å˜•ë´™å™¸æ²˜ëƒ‹è–µáŸ�ꞎí·�䢌Ʈ俔暄憎隺⦣浺㽊䈪蓀濸뼌ﺡ뀞㖄ä…�æš´í¦ˆá¯ á¸ºì‡�ꕴ㙠ⷑ缔ٓ푆稱뛈î�µí¯„⨖ْ䊂巙ʬæ�ºã›�ﶂ斟ᣠኽ妆⽆낟㴹ä�¥ïˆ´è¬Ÿé‰¡á¡¯í¼³ç›ší´’ãŸ½ì§½æ‡®í€”è‹Ÿè»Œíƒ”âª¿é˜²êŠ¯ã»˜ì¸—ïš·ê€°í¡›áº…í°°á¯¤çŸºï¨”â’›í©Žà·´å…�歋ㄗ촡쑿ꎒ퀗嚲쟑嬶å��顙鷩ï�™äŸ²ê¹‚ê½‚à¾¾í¾”ä�Œé£·í µì˜¾á‡ˆà¬–à¹¡å…¨í¼–ç»†ê‰šâ°¼ç²¢áŒ‰ë¬®ì‹¼à´”è“„ç�™æµ¬â‚¡æ›„æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3233)=>[Subject: Fedex tracking number 2947403134][Date: Fri, 22 Aug 2008 04:13:29 -0800]=>(MIME part)=>NNMA6766122.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3233)=>[Subject: Fedex tracking number 2947403134][Date: Fri, 22 Aug 2008 04:13:29 -0800]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3233)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3241)=>[Subject: Statement of fees 2008/09][Date: Mon, 25 Aug 2008 06:05:01 +0100]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc_


Infected with: Trojan.Inject.RB

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3241)=>[Subject: Statement of fees 2008/09][Date: Mon, 25 Aug 2008 06:05:01 +0100]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc_


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3241)=>[Subject: Statement of fees 2008/09][Date: Mon, 25 Aug 2008 06:05:01 +0100]=>(MIME part)=>Fees_2008-2009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3241)=>[Subject: Statement of fees 2008/09][Date: Mon, 25 Aug 2008 06:05:01 +0100]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3241)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3242)=>[Subject: Western Union MTCN #2422130883][Date: Mon, 25 Aug 2008 11:38:57 +0100]=>(MIME part)=>MTCN08662112.zip=>MTCN08662112.exe燼ﭒ霗꽗๭쭯䅚⳻颓濣䉽瓻㕜侾쎚嬽뜋孩ৈ顡ä¦�缫㘚鶑鵌㾲æ�‰î�¦ï¥šç²�á•…î¤²é¿‹ê»Šè «ç£¿î«�魞㽣Ū歑뫓釕㤯â�§ãž˜çš¶â››æœ¹äµ¬ï¾’ï´¸ë©�ｧ咤歧崆ì�—ì™™ç˜¤êŒ°è´ ìœ�㸾䘚ףּᢴç�”姚谑â®�ï·«é½›í··í«œê¦²ï³¥âº³í¦ší�‰åš½í¶…ã‘¡í°›í­µì³“ìŠ…æ©†ë°ºå§‚ê©‹â§£è·¬æ¼¤ã¾“é³Žï—¹áƒ¾î¶¯í¦¤è †æ´¸èŽ³é˜¹åµ™äˆƒèº˜ä�˜ì³»è’¶ê±°è’�ê‰°æ©½â†‘ã£—á««ê„Žé©½ä ´í¹´ê¶“ê�­â²Žé�¢ä¶ƒï®¨É¸ã�“ꂮ䑞㫣䛕ᯈ顜㧽槖圡䭈錙í�ªä˜Žç’¿ê¶‡ç—�ᰭ㒢눛鿥ꑳí�¦ä¬¿êº¥î�Ží�–猊ﴥ꾟椲쒉뱋㖰í�šá‚�ã—´ä’�컿䰼舒ï�¾íº‘ã´�쫱憭᭎⮳溢å�¥ä»ˆï¹¦æ®«î»”éŸºíš’ã”—â˜µë™­í¢†èŠƒè¿¤ç¶£ê�šî¢‚隤黇蔓쳆攅鳆줈滯햰ë�•á§Šâ•„㒵ወ䧗״榦ठ姑᳒伢í¿�ï™†æ…¥íµ¹è»Šî‡µî¢›àººç¦®ë³¦â³­æ…·å–†è‹—æ²�㤌ë�Ÿæ¾²ä¾«è §ë�šä¿…ﶪ䉳暒꫗쑵䤣볋喪舧꿎䣓⟋왊樷鹞Infected with: Trojan.Spy.ZBot.KE


Infected with: Trojan.Spy.ZBot.KE

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3242)=>[Subject: Western Union MTCN #2422130883][Date: Mon, 25 Aug 2008 11:38:57 +0100]=>(MIME part)=>MTCN08662112.zip=>MTCN08662112.exe2112.exe燼ﭒ霗꽗๭쭯䅚⳻颓濣䉽瓻㕜侾쎚嬽뜋孩ৈ顡ä¦�缫㘚鶑鵌㾲æ�‰î�¦ï¥šç²�á•…î¤²é¿‹ê»Šè «ç£¿î«�魞㽣Ū歑뫓釕㤯â�§ãž˜çš¶â››æœ¹äµ¬ï¾’ï´¸ë©�ｧ咤歧崆ì�—ì™™ç˜¤êŒ°è´ ìœ�㸾䘚ףּᢴç�”姚谑â®�ï·«é½›í··í«œê¦²ï³¥âº³í¦ší�‰åš½í¶…ã‘¡í°›í­µì³“ìŠ…æ©†ë°ºå§‚ê©‹â§£è·¬æ¼¤ã¾“é³Žï—¹áƒ¾î¶¯í¦¤è †æ´¸èŽ³é˜¹åµ™äˆƒèº˜ä�˜ì³»è’¶ê±°è’�ê‰°æ©½â†‘ã£—á««ê„Žé©½ä ´í¹´ê¶“ê�­â²Žé�¢ä¶ƒï®¨É¸ã�“ꂮ䑞㫣䛕ᯈ顜㧽槖圡䭈錙í�ªä˜Žç’¿ê¶‡ç—�ᰭ㒢눛鿥ꑳí�¦ä¬¿êº¥î�Ží�–猊ﴥ꾟椲쒉뱋㖰í�šá‚�ã—´ä’�컿䰼舒ï�¾íº‘ã´�쫱憭᭎⮳溢å�¥ä»ˆï¹¦æ®«î»”éŸºíš’ã”—â˜µë™­í¢†èŠƒè¿¤ç¶£ê�šî¢‚隤黇蔓쳆攅鳆줈滯햰ë�•á§Šâ•„㒵ወ䧗״榦ठ姑᳒伢í¿�ï™†æ…¥íµ¹è»Šî‡µî¢›àººç¦®ë³¦â³­æ…·å–†è‹—æ²�㤌ë�Ÿæ¾²ä¾«è §ë�šä¿…ﶪ䉳暒꫗쑵æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3242)=>[Subject: Western Union MTCN #2422130883][Date: Mon, 25 Aug 2008 11:38:57 +0100]=>(MIME part)=>MTCN08662112.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3242)=>[Subject: Western Union MTCN #2422130883][Date: Mon, 25 Aug 2008 11:38:57 +0100]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3242)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3257)=>[Subject: Statement of fees 2008/09][Date: Wed, 27 Aug 2008 08:02:32 +0100]=>(MIME part)=>Fees-2008_2009.zip=>Fees-2008_2009.doc.ꚅᷣ圪å�‹ã”¸ì‘»í‰€ë·‰í‡·ïƒ‹ê°™î£•ï�¶æ¡­ëˆ²äœ›ç¥¥ï–ƒç¨­æˆ¼î¤§â—¥ä‘”î˜›í¯¦è°™ì‚¦è¿ªç½¨í™»ä›±âª½â�«ì‘©ã»¦ì„›îœ“턓浭壘턃豟存횱î¤�Ʈ桬㠆뭭ㇴ㮒鷑混ꞻ먢笱펢ä�žé¨µî¶¢â´»æ�«îž³ì¬¤è£‡ì�¯êªšè»Ží²�Ë›ë³�ᰔ₭탊ृç¨�쓪ì«�꽇ê�‡è‘žä§‚í„�ῑ꿓륿螬誅暖摷è¢�ë‘šæ‰µäˆ™â½›í¨œå¡ºã«�옓䧸߃纱೬˖뫚녱ꄺ宙죆䔚Ꭼ笅ä™�ï±¼ò¡�’僲å™�窡㺨驜ã´�àº”î›¿à¢¨ê¢°á–¡í¿„è´™ë–�ኵῖ簭帻á•�逹⚇嚨檰㵫è–�롲ï�‡ã›£í­¹à¤Žê£´ê‡³î­«à¾§è“Ÿà±…ã¡”ãŒ¯á±¢à»¸íŸ—í¶¿è¼¢è¾—ë“¨æ†­é¾¡è­¿å‹™ïµ­å™”æ´Ží£½áµµë ­è¨€Ô‡ê¾¡Ì§í”€è»–ï´›ê¶¡é¢•Ñµà¡«ê�«á–­ä˜»î¶¢î§›à²ºæ±²ëš‚硗瀱ᇨí–�洊籼醬ï“�à­�첟å£�í •âŸ‹Þ¡í¤­ç—µé»¨ë¾€ë¾‚í¹šá ‡à¥“ï³¼ë¡¬î—¼í›ˆã³‚ì™Žâ¬‡íŽ°ê€•è²¦ç±¼ç¥°çˆ‚á…�寈ܡí��졸묢趑ê™�謿쥟㲆ϋé–�ã�Žç™ŽåŒƒæ—«è�Œâ• ã¨�ä„•Infected with: Trojan.Downloader.JKON


Infected with: Trojan.Downloader.JKON

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3257)=>[Subject: Statement of fees 2008/09][Date: Wed, 27 Aug 2008 08:02:32 +0100]=>(MIME part)=>Fees-2008_2009.zip=>Fees-2008_2009.doc.009.doc.ꚅᷣ圪å�‹ã”¸ì‘»í‰€ë·‰í‡·ïƒ‹ê°™î£•ï�¶æ¡­ëˆ²äœ›ç¥¥ï–ƒç¨­æˆ¼î¤§â—¥ä‘”î˜›í¯¦è°™ì‚¦è¿ªç½¨í™»ä›±âª½â�«ì‘©ã»¦ì„›îœ“턓浭壘턃豟存횱î¤�Ʈ桬㠆뭭ㇴ㮒鷑混ꞻ먢笱펢ä�žé¨µî¶¢â´»æ�«îž³ì¬¤è£‡ì�¯êªšè»Ží²�Ë›ë³�ᰔ₭탊ृç¨�쓪ì«�꽇ê�‡è‘žä§‚í„�ῑ꿓륿螬誅暖摷è¢�ë‘šæ‰µäˆ™â½›í¨œå¡ºã«�옓䧸߃纱೬˖뫚녱ꄺ宙죆䔚Ꭼ笅ä™�ï±¼ò¡�’僲å™�窡㺨驜ã´�àº”î›¿à¢¨ê¢°á–¡í¿„è´™ë–�ኵῖ簭帻á•�逹⚇嚨檰㵫è–�롲ï�‡ã›£í­¹à¤Žê£´ê‡³î­«à¾§è“Ÿà±…ã¡”ãŒ¯á±¢à»¸íŸ—í¶¿è¼¢è¾—ë“¨æ†­é¾¡è­¿å‹™ïµ­å™”æ´Ží£½áµµë ­è¨€Ô‡ê¾¡Ì§í”€è»–ï´›ê¶¡é¢•Ñµà¡«ê�«á–­ä˜»î¶¢î§›à²ºæ±²ëš‚硗瀱ᇨí–�洊籼醬ï“�à­�첟å£�í •âŸ‹Þ¡í¤­ç—µé»¨ë¾€ë¾‚í¹šá ‡à¥“ï³¼ë¡¬î—¼í›ˆã³‚ì™Žâ¬‡íŽ°ê€•è²¦ç±¼ç¥°çˆ‚á…�寈ܡí��졸묢趑ê™�謿쥟㲆æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3257)=>[Subject: Statement of fees 2008/09][Date: Wed, 27 Aug 2008 08:02:32 +0100]=>(MIME part)=>Fees-2008_2009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3257)=>[Subject: Statement of fees 2008/09][Date: Wed, 27 Aug 2008 08:02:32 +0100]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3257)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3275)=>[Subject: Western Union MTCN #4224281131][Date:?Wed, 27 Aug 2008 19:42:36 -0500]=>(MIME part)=>MT77232.zip=>MT77232.exe


Infected with: Trojan.Spy.Wsnpoem.HR

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3275)=>[Subject: Western Union MTCN #4224281131][Date:?Wed, 27 Aug 2008 19:42:36 -0500]=>(MIME part)=>MT77232.zip=>MT77232.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3275)=>[Subject: Western Union MTCN #4224281131][Date:?Wed, 27 Aug 2008 19:42:36 -0500]=>(MIME part)=>MT77232.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3275)=>[Subject: Western Union MTCN #4224281131][Date:?Wed, 27 Aug 2008 19:42:36 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3275)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3291)=>[Subject: Western Union MTCN #7328925489][Date: Thu, 28 Aug 2008 10:34:36 -0700]=>(MIME part)=>MT77232.zip=>MT77232.exe


Infected with: Trojan.Spy.Wsnpoem.HR

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3291)=>[Subject: Western Union MTCN #7328925489][Date: Thu, 28 Aug 2008 10:34:36 -0700]=>(MIME part)=>MT77232.zip=>MT77232.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3291)=>[Subject: Western Union MTCN #7328925489][Date: Thu, 28 Aug 2008 10:34:36 -0700]=>(MIME part)=>MT77232.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3291)=>[Subject: Western Union MTCN #7328925489][Date: Thu, 28 Aug 2008 10:34:36 -0700]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3291)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3294)=>[Subject: Statement of fees 2008/09][Date: Fri, 29 Aug 2008 05:04:00 +0000]=>(MIME part)=>Fees-2008_2009.zip=>Fees-2008_2009.doc.ì²–Ü•é„¯é¼®æŠ¼í¸¼ç£‡é˜®ëŒ†ë€µå�«á¼ªé¯�뿥᱌侗ഋè¼�ݕﲅ膖ë�–绥ê‡�â��쎃⛰䎉繥얊暢䦎䯾陵ä�¸Ï„ëŠ�ç“ ï�©ï†²é«¿ìž–⅋玂辟肅ᶵ㭡훵蟳피釧㒱á�“᭙ୋ㻭䱳ꖌ⸽ì�¤â›’顇䲄ç—�ຨå®�瀇㕉à½�è”�檚嗎횚ફꇗï�¦îº€ê£©êš¾äˆªæ¹ 䘨Ϯ좗ì�–䀎騨ڡꙄ뗗鬦㗞粂ë�©æ�¼ç¦¯ï€Ÿá¹“⊇䑆ë��Ꞓ짔ä·�è°¹ê‰ªà¦¥ï…™è‰ í°ƒå™Œá¢¯ë•†é£¸î´…êˆ¹è¸�í¨ƒä‘£æ„›î»™é�§ï‡¤Ý„躴횈鋑ᾶ䮵㉀ⅇ僚婋ä�¿è•»É¨æ­„엑뇓毒╢ê­�äš�îª à¸†à»·è› Ô¢î••è†»à½ªé¨†èŒ†îµ·à¤¶ï‰¿ë¾©ä¹›Ë“é��è •ê¬ªç‚°ì‚„áº³ë‘žÈ…ä¥„à³§ç…§î‚ªâ°¼ä�¿ä˜‹è…®ê²¡ê«µç“£à°¥êª€á¼¡ä©µë»“䵌ï�…á€¯î˜ ç“´îš¦ã€ á�®ä�Œï–²è«©ÔŠìš�궨骙ì�ƒæ‹¤ëª—㔽튅䙥㖫넚貌쪖赈鹔☪匳髅쨕煀晘䪪ᆢì�‡äˆ„ⰽ⽓䣑쑂墤阓ꤙ裔䮗狤咽ಮ魜䪙摊áˆ�è��â�žâ¤•î‹¥á£Œê¤µæª’í¾”å�€áš­â�¸åŠ¤à¬ªä³‹è™�å…�䤲å²�Infected with: Trojan.Inject.QU


Infected with: Trojan.Inject.QU

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3294)=>[Subject: Statement of fees 2008/09][Date: Fri, 29 Aug 2008 05:04:00 +0000]=>(MIME part)=>Fees-2008_2009.zip=>Fees-2008_2009.doc.009.doc.ì²–Ü•é„¯é¼®æŠ¼í¸¼ç£‡é˜®ëŒ†ë€µå�«á¼ªé¯�뿥᱌侗ഋè¼�ݕﲅ膖ë�–绥ê‡�â��쎃⛰䎉繥얊暢䦎䯾陵ä�¸Ï„ëŠ�ç“ ï�©ï†²é«¿ìž–⅋玂辟肅ᶵ㭡훵蟳피釧㒱á�“᭙ୋ㻭䱳ꖌ⸽ì�¤â›’顇䲄ç—�ຨå®�瀇㕉à½�è”�檚嗎횚ફꇗï�¦îº€ê£©êš¾äˆªæ¹ 䘨Ϯ좗ì�–䀎騨ڡꙄ뗗鬦㗞粂ë�©æ�¼ç¦¯ï€Ÿá¹“⊇䑆ë��Ꞓ짔ä·�è°¹ê‰ªà¦¥ï…™è‰ í°ƒå™Œá¢¯ë•†é£¸î´…êˆ¹è¸�í¨ƒä‘£æ„›î»™é�§ï‡¤Ý„躴횈鋑ᾶ䮵㉀ⅇ僚婋ä�¿è•»É¨æ­„엑뇓毒╢ê­�äš�îª à¸†à»·è› Ô¢î••è†»à½ªé¨†èŒ†îµ·à¤¶ï‰¿ë¾©ä¹›Ë“é��è •ê¬ªç‚°ì‚„áº³ë‘žÈ…ä¥„à³§ç…§î‚ªâ°¼ä�¿ä˜‹è…®ê²¡ê«µç“£à°¥êª€á¼¡ä©µë»“䵌ï�…á€¯î˜ ç“´îš¦ã€ á�®ä�Œï–²è«©ÔŠìš�궨骙ì�ƒæ‹¤ëª—㔽튅䙥㖫넚貌쪖赈鹔☪匳髅쨕煀晘䪪ᆢì�‡äˆ„ⰽ⽓䣑쑂墤阓ꤙ裔䮗狤咽ಮ魜䪙摊áˆ�è��â�žâ¤•î‹¥á£Œê¤µæª’í¾”å�€áš­æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3294)=>[Subject: Statement of fees 2008/09][Date: Fri, 29 Aug 2008 05:04:00 +0000]=>(MIME part)=>Fees-2008_2009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3294)=>[Subject: Statement of fees 2008/09][Date: Fri, 29 Aug 2008 05:04:00 +0000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3294)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3314)=>[Subject: AIRMAIL EXPRESS $_ 4327599756][Date: Sat, 30 Aug 2008 10:48:10 -0500]=>(MIME part)=>AIRMAIL#7661224.zip=>AIRMAIL#76612租憺꿶猋ê�¿ê�¾æƒ»ë¿Œë¿†í�§ï™«ã¤�äŽ�◽簬縷킔í�’å’™å�—騞ã°�퟉易è�¦ï¶–ⷧ㮪졘à»�ꯒ㯻垊鑵릩ﾲî�·ë°¿ç½¦ë®‘î½—ï¬‹å¦³ã“¸ã³ºãˆ‘ë¨²ë™†äº¤ç½¦íª­î˜°æ˜‰ëƒ¹í¤ºîŽ�åº�æ¿�è¿°ï²�滧鶒誼䎅á”�瑂麢෕謈ᛪ䃚Þ�è��ì¡–í‹‹åž¬í¿ƒá�—ï�±ì•ªæŸ‚é¯¶ã¬¿é”¥ïª˜ä„“æƒ«îªšê©½ç¿Šæ»œí¶¤à´˜ï¶¤éŒ›ç‰¹Öªá·©æ¹´è¿¹ï«­ã«Œæ¸šïªŒè¥“è¢•é�¾è ¯ä¾›ç»¾æ¿·å�—筑⼵鱩॔啔걂ꨣ䇉ꭧï¢�íŠ«ä‚€â‚¬Ï¶ë¨‘ê“¤ç‰»ï‘¶éŠ£ç•…îˆ“íž¶í§²á—‘ê¬¥æ“»ï½‹è®†ç²†è¼¡ç‹ƒä„°ë¬ î·¸êª‰å€¯ê ¼ê�®íº¬à²¤î¢¼î¯µë¬“솙엟㲘㗧俔î�®ç¼‘ᢓ嵑ﰥౄ㵄ﰟæ”�í„Ÿâ�¿ï®€ë‹�ã›�æŽ�牉븼럹î�…凕感᷇絺쟣惄͵䛥ি祹⬗è¦�ᒇ췕㟔咞ï©�鴧ﱨ鹿㳮埔á‰�걂í¶�ê¡—æ�®ç‰ºá�ˆçž�ꮪͩã½�貹똄媿㺈⻂ã�‘傔韶â�€è‚¡é�¢ë¬°æ¹…練鄬齟췓볿ë�®ï¾³á‘ˆíŸ‰å—“㾳槾ﺨæ¹�î«ˆé´ƒì¡—æŸˆî ›ï¶œçŽ»ë€ á…•çµ˜é�¾à»»ë‰´Infected with: Trojan.Spy.ZBot.KQ


Infected with: Trojan.Spy.ZBot.KQ

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3314)=>[Subject: AIRMAIL EXPRESS $_ 4327599756][Date: Sat, 30 Aug 2008 10:48:10 -0500]=>(MIME part)=>AIRMAIL#7661224.zip=>AIRMAIL#76612IL#76612租憺꿶猋ê�¿ê�¾æƒ»ë¿Œë¿†í�§ï™«ã¤�äŽ�◽簬縷킔í�’å’™å�—騞ã°�퟉易è�¦ï¶–ⷧ㮪졘à»�ꯒ㯻垊鑵릩ﾲî�·ë°¿ç½¦ë®‘î½—ï¬‹å¦³ã“¸ã³ºãˆ‘ë¨²ë™†äº¤ç½¦íª­î˜°æ˜‰ëƒ¹í¤ºîŽ�åº�æ¿�è¿°ï²�滧鶒誼䎅á”�瑂麢෕謈ᛪ䃚Þ�è��ì¡–í‹‹åž¬í¿ƒá�—ï�±ì•ªæŸ‚é¯¶ã¬¿é”¥ïª˜ä„“æƒ«îªšê©½ç¿Šæ»œí¶¤à´˜ï¶¤éŒ›ç‰¹Öªá·©æ¹´è¿¹ï«­ã«Œæ¸šïªŒè¥“è¢•é�¾è ¯ä¾›ç»¾æ¿·å�—筑⼵鱩॔啔걂ꨣ䇉ꭧï¢�íŠ«ä‚€â‚¬Ï¶ë¨‘ê“¤ç‰»ï‘¶éŠ£ç•…îˆ“íž¶í§²á—‘ê¬¥æ“»ï½‹è®†ç²†è¼¡ç‹ƒä„°ë¬ î·¸êª‰å€¯ê ¼ê�®íº¬à²¤î¢¼î¯µë¬“솙엟㲘㗧俔î�®ç¼‘ᢓ嵑ﰥౄ㵄ﰟæ”�í„Ÿâ�¿ï®€ë‹�ã›�æŽ�牉븼럹î�…凕感᷇絺쟣惄͵䛥ি祹⬗è¦�ᒇ췕㟔咞ï©�鴧ﱨ鹿㳮埔á‰�걂í¶�ê¡—æ�®ç‰ºá�ˆçž�ꮪͩã½�貹똄媿㺈⻂ã�‘傔韶â�€è‚¡é�¢ë¬°æ¹…練鄬齟췓볿ë�®ï¾³á‘ˆíŸ‰å—“㾳槾ﺨæ¹�鴃졗æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3314)=>[Subject: AIRMAIL EXPRESS $_ 4327599756][Date: Sat, 30 Aug 2008 10:48:10 -0500]=>(MIME part)=>AIRMAIL#7661224.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3314)=>[Subject: AIRMAIL EXPRESS $_ 4327599756][Date: Sat, 30 Aug 2008 10:48:10 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3314)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3318)=>[Subject: Statement of fees 2008/09][Date: Sun, 31 Aug 2008 21:43:33 -0700]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.㵘슱佺헴淀퀅ᳵᒩ๖쯴膥┳묹í�ºå¹ˆí�šá¨ªç�˜ì €á§�ãš ç‹·ç¢ Î»æ°�渎ꮋꞷ촃旑扜褋틌ï¬�膡ᘃ酥꥛朔ç¾�늆ᒬ廸矱í��ä³—æ§—í»¿çŽ…áŸƒâ‰©é‰¨èœ±ìˆ¦ë•—åµ¹âš‰èº¢æª”ì°¢å¿“â«�é’•ëˆŒí«’è‚…èªŽá�†í·©îœ ç¿†ä„˜íµŒáŸŽæ«‚ä‚¯çœ¹ï´¥å®�â�žçŸ³ì±£ì€¬ç­´ã‘›ã£�á …î�®ã­”︬䯶匱ئ⟨î®�䭉ç¼�ï�“â Žà¬ˆå¥Œãžšë”½ê¬›î›Šâ¦¸î¹Œæ†‚î ¹ä›‚æ…°ï—šê¢£ê³›ä§´é½¥í¥ ã‹‰ê™�ì¬‰âž¤î¯—é¨€í¿”Ë�奥䲰牥姙佘膌୥霦脽ὥ奡áŸ�ã™�è–�㊻äž�Ĺí±�∠픀출ٛ퉸ê€�䡛⠆Ã�ì ºÉœå®¬ì…¥é»·îž£á¡˜á‚‚é¦¸è„¿è¢ªä¦�₆ï�°êž€È«é˜�나츻맢摙視äµ�á±°ç„¦âŽˆæº¦ä¡¥á ‚ëœ€à³¶â£�ì¿�⚉è„�áŠŽå€ˆì“˜ä´„ÝŠí®‚ìˆ‰ë��覩衻戻튎í�‡ãŽ¤æ�€é•­ç›™ä¬³ê†¢áš�Ú�ã’¦è­ƒì§ªå† æ˜©è˜¤ï€�å½€ã�—î²£í³Œí¾€ã–’î„œë‹¬Ô³á„�â�žè¤†æ·¦î®§â�Šèƒ¹ã¡‡â©“í—…ì¿‘è³Žîƒ¡ç™‰é† æ¥�á�”੗仉캃ê�°å³’è�·åºªä�žè‡‚䫡㎶â�¦â¼·Infected with: Win32.Worm.Autorun.MD


Infected with: Win32.Worm.Autorun.MD

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3318)=>[Subject: Statement of fees 2008/09][Date: Sun, 31 Aug 2008 21:43:33 -0700]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.009.doc.㵘슱佺헴淀퀅ᳵᒩ๖쯴膥┳묹í�ºå¹ˆí�šá¨ªç�˜ì €á§�ãš ç‹·ç¢ Î»æ°�渎ꮋꞷ촃旑扜褋틌ï¬�膡ᘃ酥꥛朔ç¾�늆ᒬ廸矱í��ä³—æ§—í»¿çŽ…áŸƒâ‰©é‰¨èœ±ìˆ¦ë•—åµ¹âš‰èº¢æª”ì°¢å¿“â«�é’•ëˆŒí«’è‚…èªŽá�†í·©îœ ç¿†ä„˜íµŒáŸŽæ«‚ä‚¯çœ¹ï´¥å®�â�žçŸ³ì±£ì€¬ç­´ã‘›ã£�á …î�®ã­”︬䯶匱ئ⟨î®�䭉ç¼�ï�“â Žà¬ˆå¥Œãžšë”½ê¬›î›Šâ¦¸î¹Œæ†‚î ¹ä›‚æ…°ï—šê¢£ê³›ä§´é½¥í¥ ã‹‰ê™�ì¬‰âž¤î¯—é¨€í¿”Ë�奥䲰牥姙佘膌୥霦脽ὥ奡áŸ�ã™�è–�㊻äž�Ĺí±�∠픀출ٛ퉸ê€�䡛⠆Ã�ì ºÉœå®¬ì…¥é»·îž£á¡˜á‚‚é¦¸è„¿è¢ªä¦�₆ï�°êž€È«é˜�나츻맢摙視äµ�á±°ç„¦âŽˆæº¦ä¡¥á ‚ëœ€à³¶â£�ì¿�⚉è„�áŠŽå€ˆì“˜ä´„ÝŠí®‚ìˆ‰ë��覩衻戻튎í�‡ãŽ¤æ�€é•­ç›™ä¬³ê†¢áš�Ú�ã’¦è­ƒì§ªå† æ˜©è˜¤ï€�å½€ã�—î²£í³Œí¾€ã–’î„œë‹¬Ô³á„�â�žè¤†æ·¦î®§â�Šèƒ¹ã¡‡â©“í—…ì¿‘è³Žîƒ¡ç™‰é† æ¥�á�”੗仉캃ê�°å³’æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3318)=>[Subject: Statement of fees 2008/09][Date: Sun, 31 Aug 2008 21:43:33 -0700]=>(MIME part)=>Fees_2008-2009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3318)=>[Subject: Statement of fees 2008/09][Date: Sun, 31 Aug 2008 21:43:33 -0700]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3318)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3329)=>[Subject: Airmail Tracking number #2629037][Date: Mon, 1 Sep 2008 10:16:53 -0800]=>(MIME part)=>AIRMAIL_TRACKING.doc.zip=>AIRMAIL


Infected with: Trojan.FakeAlert.Gen.2

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3329)=>[Subject: Airmail Tracking number #2629037][Date: Mon, 1 Sep 2008 10:16:53 -0800]=>(MIME part)=>AIRMAIL_TRACKING.doc.zip=>AIRMAIL


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3329)=>[Subject: Airmail Tracking number #2629037][Date: Mon, 1 Sep 2008 10:16:53 -0800]=>(MIME part)=>AIRMAIL_TRACKING.doc.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3329)=>[Subject: Airmail Tracking number #2629037][Date: Mon, 1 Sep 2008 10:16:53 -0800]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3329)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3331)=>[Subject: Airmail Tracking number #9674169][Date: Mon, 1 Sep 2008 20:48:25 -0500]=>(MIME part)=>#876712.zip=>#876712.exe


Infected with: Trojan.Spy.Wsnpoem.HY

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3331)=>[Subject: Airmail Tracking number #9674169][Date: Mon, 1 Sep 2008 20:48:25 -0500]=>(MIME part)=>#876712.zip=>#876712.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3331)=>[Subject: Airmail Tracking number #9674169][Date: Mon, 1 Sep 2008 20:48:25 -0500]=>(MIME part)=>#876712.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3331)=>[Subject: Airmail Tracking number #9674169][Date: Mon, 1 Sep 2008 20:48:25 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3331)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3332)=>[Subject: Statement of fees 2008/09][Date: Tue, 2 Sep 2008 15:15:47 +0930]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.e


Infected with: Win32.Worm.Autorun.MK

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3332)=>[Subject: Statement of fees 2008/09][Date: Tue, 2 Sep 2008 15:15:47 +0930]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.e


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3332)=>[Subject: Statement of fees 2008/09][Date: Tue, 2 Sep 2008 15:15:47 +0930]=>(MIME part)=>Fees_2008-2009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3332)=>[Subject: Statement of fees 2008/09][Date: Tue, 2 Sep 2008 15:15:47 +0930]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3332)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3333)=>[Subject: Airmail Tracking number #9584935][Date: Tue, 2 Sep 2008 16:27:15 +0900]=>(MIME part)=>#876712.zip=>#876712.exe


Infected with: Trojan.Spy.Wsnpoem.HY

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3333)=>[Subject: Airmail Tracking number #9584935][Date: Tue, 2 Sep 2008 16:27:15 +0900]=>(MIME part)=>#876712.zip=>#876712.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3333)=>[Subject: Airmail Tracking number #9584935][Date: Tue, 2 Sep 2008 16:27:15 +0900]=>(MIME part)=>#876712.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3333)=>[Subject: Airmail Tracking number #9584935][Date: Tue, 2 Sep 2008 16:27:15 +0900]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3333)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3369)=>[Subject: Airmail Tracking number #6550127][Date: Wed, 3 Sep 2008 13:47:06 -0600]=>(MIME part)=>5322412.zip=>5322412.exe


Infected with: Trojan.Spy.ZBot.KX

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3369)=>[Subject: Airmail Tracking number #6550127][Date: Wed, 3 Sep 2008 13:47:06 -0600]=>(MIME part)=>5322412.zip=>5322412.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3369)=>[Subject: Airmail Tracking number #6550127][Date: Wed, 3 Sep 2008 13:47:06 -0600]=>(MIME part)=>5322412.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3369)=>[Subject: Airmail Tracking number #6550127][Date: Wed, 3 Sep 2008 13:47:06 -0600]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3369)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3371)=>[Subject: Statement of fees 2008/09][Date:?Thu, 4 Sep 2008 16:47:12 +1000]=>(MIME part)=>Fees_2007-2008.zip=>Fees_2007-2008.doc.e


Infected with: Trojan.Crypt.EE

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3371)=>[Subject: Statement of fees 2008/09][Date:?Thu, 4 Sep 2008 16:47:12 +1000]=>(MIME part)=>Fees_2007-2008.zip=>Fees_2007-2008.doc.e


Disinfection failed

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3371)=>[Subject: Statement of fees 2008/09][Date:?Thu, 4 Sep 2008 16:47:12 +1000]=>(MIME part)=>Fees_2007-2008.zip=>Fees_2007-2008.doc.e08.doc.e


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3371)=>[Subject: Statement of fees 2008/09][Date:?Thu, 4 Sep 2008 16:47:12 +1000]=>(MIME part)=>Fees_2007-2008.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3371)=>[Subject: Statement of fees 2008/09][Date:?Thu, 4 Sep 2008 16:47:12 +1000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3371)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3407)=>[Subject: Western Union MTCN #0366396735][Date:?Sun, 7 Sep 2008 15:36:33 -0500]=>(MIME part)=>MTCN.zip=>MTCN.exe


Infected with: Trojan.Spy.ZBot.KY

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3407)=>[Subject: Western Union MTCN #0366396735][Date:?Sun, 7 Sep 2008 15:36:33 -0500]=>(MIME part)=>MTCN.zip=>MTCN.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3407)=>[Subject: Western Union MTCN #0366396735][Date:?Sun, 7 Sep 2008 15:36:33 -0500]=>(MIME part)=>MTCN.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3407)=>[Subject: Western Union MTCN #0366396735][Date:?Sun, 7 Sep 2008 15:36:33 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3407)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3412)=>[Subject: Statement of fees 2008/09][Date: Mon, 8 Sep 2008 07:43:13 +0000]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.eï°¿ÒŸä½¶æˆ¶ãž½í‚Šé§ƒî ƒáº¦ãˆ”Ü»á—ºà¥‚ì�–磙ﭹ蒆պ䀛í�¡â€�漷窀ë�ƒã¤›á¿„ç�°ëº†è„¡ê…®ã¸žá‰£åº†ë˜¤í¡¾ã´�뀜鬨Ꜵë¶�ﻵ쨙씻뼊ké©‡ãŠªæµµïŸ«á°Žæ†™è½¢ìª á¥–ä£¶ï•²âž�ै澢ë‚�ç ´Ë€ë²¥æ�€á°‹Ë—剚䄘똊ᲂ䔹ä„�歕땡å�–喞魇㙇ꒀ囩릌〚緉㦌䘿ì€�æ§¢á’¿æº³è‡ ì£¾ï´±å±€â›¹áŸ ã¦·ä…�ä�˜æ­¢ï¸®ã»¬é•šâ‡ƒé°¿×˜åµ«è—�ૂ䗥牑搜늄塎嬶é�‡ì€¹èŠ²ï–‰~â•�ï•Ÿí¥€å ¢ã‘–æ²±ê°¹Ý§è©µë‹€á�ƒí»‹ë‹ƒå¡�㯆é�…æŽ�꫉æ�£â‹Ÿà ∙倂㤽垀Ā▒䃔â�©ä‡�⅖溰澵庌焹愄녦肸椪উ悆Ꞃ☫阓煸츺釦å�½ï©£è³§ì‰³ç€¦ìŽˆëˆ¤äˆŽÌ€á¹€Í�Ê�é§½ãŠ¨î ¿éŒ¨è”‰ë²½æ•�â�µé¦¸á™¹â›ªï¥¹ï¡‹é¸£æ´¨å”˜Þ–é¼ ç­•ï™¬â�°ë­ší‹›î�¢è†©å­´â�Šé¸½î°’ê•�ç®»î��Ê“ê¡‚î¹±î�žç¢°ê‘ªà¡�쟈鎹苃璨籪뮜ä�ƒã”¼ä°‘ã¡©ä�¯ë¡¶í�»ËƒìŒ£â�¢ï…‰è¢”悀뮪è´�Ꙏ߄ݬá�•è€’á¡„è€½á ’æ»§á€“Infected with: Trojan.Autorun.YM


Infected with: Trojan.Autorun.YM

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3412)=>[Subject: Statement of fees 2008/09][Date: Mon, 8 Sep 2008 07:43:13 +0000]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.e09.doc.eï°¿ÒŸä½¶æˆ¶ãž½í‚Šé§ƒî ƒáº¦ãˆ”Ü»á—ºà¥‚ì�–磙ﭹ蒆պ䀛í�¡â€�漷窀ë�ƒã¤›á¿„ç�°ëº†è„¡ê…®ã¸žá‰£åº†ë˜¤í¡¾ã´�뀜鬨Ꜵë¶�ﻵ쨙씻뼊ké©‡ãŠªæµµïŸ«á°Žæ†™è½¢ìª á¥–ä£¶ï•²âž�ै澢ë‚�ç ´Ë€ë²¥æ�€á°‹Ë—剚䄘똊ᲂ䔹ä„�歕땡å�–喞魇㙇ꒀ囩릌〚緉㦌䘿ì€�æ§¢á’¿æº³è‡ ì£¾ï´±å±€â›¹áŸ ã¦·ä…�ä�˜æ­¢ï¸®ã»¬é•šâ‡ƒé°¿×˜åµ«è—�ૂ䗥牑搜늄塎嬶é�‡ì€¹èŠ²ï–‰~â•�ï•Ÿí¥€å ¢ã‘–æ²±ê°¹Ý§è©µë‹€á�ƒí»‹ë‹ƒå¡�㯆é�…æŽ�꫉æ�£â‹Ÿà ∙倂㤽垀Ā▒䃔â�©ä‡�⅖溰澵庌焹愄녦肸椪উ悆Ꞃ☫阓煸츺釦å�½ï©£è³§ì‰³ç€¦ìŽˆëˆ¤äˆŽÌ€á¹€Í�Ê�é§½ãŠ¨î ¿éŒ¨è”‰ë²½æ•�â�µé¦¸á™¹â›ªï¥¹ï¡‹é¸£æ´¨å”˜Þ–é¼ ç­•ï™¬â�°ë­ší‹›î�¢è†©å­´â�Šé¸½î°’ê•�ç®»î��Ê“ê¡‚î¹±î�žç¢°ê‘ªà¡�쟈鎹苃璨籪뮜ä�ƒã”¼ä°‘ã¡©ä�¯ë¡¶í�»ËƒìŒ£â�¢ï…‰è¢”悀뮪è´�æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3412)=>[Subject: Statement of fees 2008/09][Date: Mon, 8 Sep 2008 07:43:13 +0000]=>(MIME part)=>Fees_2008-2009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3412)=>[Subject: Statement of fees 2008/09][Date: Mon, 8 Sep 2008 07:43:13 +0000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3412)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3451)=>[Subject: I received a message from your bank ][Date: Tue, 9 Sep 2008 16:36:57 -0300]=>(MIME part)=>BANK_DETAILS.zip=>BANK_DETAIL㛔Ⓢ䤊貅é¡�æ�“æ�¿á»˜å¤Žéˆ¾ã˜‹ê�“⫉ä�¸å½”㊕垸㱗䒿跖⚌쫀䧆鴼䪈좻੓魉㥳懷듽醿ꘪຄ⭫㉇厶í�µã ¶ä®·é„žç’ƒî®¢å°¹ê° 扎噂掙ê¸�筻î¢�ç‚¹æ›Œåµ¸ì’ƒå¸Šåµ›í°ƒî­½î—�䵣榒䅎엺誤앾ᯛ摡购馬ꔨ᪑ⴋâ�µâ—�è �ç�¯í„µáƒ±âºŒæ³Žê±´é¢‘ì�€ê“†ç±¦ì©™äŽ¶ë¥‡â—¼ä´ƒå’®î�’ᯈ予쉧ဦ軂勫ꈛ䥢玗硓⺻믄枒໢쥽ࣽåµ�홃蜘ꥲ⻯検䰌隌啴ൡ필ã�µì™©æŒ�îµ�飨栗풵╲瓱죸憭ϕí�¡é�–ï¬Šì ›ì³–ê²�㔳犲窒蘬髃ᤞáµ�ë‰–é‹–Ó»é•¾ï§€æŽ§ëˆªëºŸí¬¼à¸”á—§Ã±í¤’å´’æ²£ï¶»ë¯’ì¢‹å­šæ�Šë‘†é�Žï¥¿é™ƒä²©í¢¶ï†¹ä¿™í—Žë¥¤è±‰ê�«ï‡¤â›¥â’ªã�µâ®©í´·ã„”줣á�šå†¬â�¾é¬»å³žçµ�í€¢îš‘ï¥ºé¨¹é¸Œæ™­ì¾°ç„Œí°§íœ›í´šê‰›è•�褨稧á�·ê¶²ã�“徆䡟蹶閑ꤰ赵飔邩ì�±ë��â™–æ‘§ä­¼é©‰ë¿«ë–•ÜŸí­‰á ½íœ¶ãœ»ãˆ³ïž¨á­šë·µí½¨è¼Œâ£¯æ’·ì˜›å»˜å¾£ëœ æ¦¬è’�蹮倬✦悟Infected with: Trojan.Spy.ZBot.LB


Infected with: Trojan.Spy.ZBot.LB

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3451)=>[Subject: I received a message from your bank ][Date: Tue, 9 Sep 2008 16:36:57 -0300]=>(MIME part)=>BANK_DETAILS.zip=>BANK_DETAILK_DETAIL㛔Ⓢ䤊貅é¡�æ�“æ�¿á»˜å¤Žéˆ¾ã˜‹ê�“⫉ä�¸å½”㊕垸㱗䒿跖⚌쫀䧆鴼䪈좻੓魉㥳懷듽醿ꘪຄ⭫㉇厶í�µã ¶ä®·é„žç’ƒî®¢å°¹ê° 扎噂掙ê¸�筻î¢�ç‚¹æ›Œåµ¸ì’ƒå¸Šåµ›í°ƒî­½î—�䵣榒䅎엺誤앾ᯛ摡购馬ꔨ᪑ⴋâ�µâ—�è �ç�¯í„µáƒ±âºŒæ³Žê±´é¢‘ì�€ê“†ç±¦ì©™äŽ¶ë¥‡â—¼ä´ƒå’®î�’ᯈ予쉧ဦ軂勫ꈛ䥢玗硓⺻믄枒໢쥽ࣽåµ�홃蜘ꥲ⻯検䰌隌啴ൡ필ã�µì™©æŒ�îµ�飨栗풵╲瓱죸憭ϕí�¡é�–ï¬Šì ›ì³–ê²�㔳犲窒蘬髃ᤞáµ�ë‰–é‹–Ó»é•¾ï§€æŽ§ëˆªëºŸí¬¼à¸”á—§Ã±í¤’å´’æ²£ï¶»ë¯’ì¢‹å­šæ�Šë‘†é�Žï¥¿é™ƒä²©í¢¶ï†¹ä¿™í—Žë¥¤è±‰ê�«ï‡¤â›¥â’ªã�µâ®©í´·ã„”줣á�šå†¬â�¾é¬»å³žçµ�í€¢îš‘ï¥ºé¨¹é¸Œæ™­ì¾°ç„Œí°§íœ›í´šê‰›è•�褨稧á�·ê¶²ã�“徆䡟蹶閑ꤰ赵飔邩ì�±ë��â™–æ‘§ä­¼é©‰ë¿«ë–•ÜŸí­‰á ½íœ¶ãœ»ãˆ³ïž¨á­šë·µí½¨è¼Œâ£¯æ’·æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3451)=>[Subject: I received a message from your bank ][Date: Tue, 9 Sep 2008 16:36:57 -0300]=>(MIME part)=>BANK_DETAILS.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3451)=>[Subject: I received a message from your bank ][Date: Tue, 9 Sep 2008 16:36:57 -0300]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3451)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3457)=>[Subject: Credit card transaction report][Date: Wed, 10 Sep 2008 10:43:54 +0100]=>(MIME part)=>Report.zip=>Report.doc 讣è� 옇ᬅ墰è�³à¦Œæ£¦áº‚ᗆ⑱æ�¸á˜±ç£®êŽ´ê�‹ê¸‰ã�„ꂽ⚋ቨ磱蘴ä�€ì¨¸áµ à±�鰽軰æ�¸á€šî‚†î·¢Ô­ì�’è—£æ�†í»�æ‘»áŠ‘æ™¨ç–„ç¨¡å†£á¢Žæ¼—Ú´î›¤ä‡¢âŠ¯ê‡ºï“±çš¬Þ á“�ç–�͆æ�¥É°ï¨®å »í›˜ë·�í¿¸é¨�혥臚通倡ì½�謙嶀塾ڼ虤ï�¶â�°ï† ë‚šã‘“í”�äŠ�溎歀밋옣á¯�ꃰâ�£à¼­é°¿ì„£ç·™äŠ‘î´‹î�Ší¬�Æ¡èœ�諒墆鮌뿆ޣå� 未䂔ë�Ÿë�ˆç»¨á¦˜ç‚†à«­â¡‘웓å�¨ï¬»ï®£å‡ªèž¨ã’¿å‚£ì‚”〹墧嘞äŠ�쒕舨캲á‘�î’ªì ¼í«¡å…¬ç’¨ë‚œí°¢á­¬ê¾¨â•£ìˆžì„©ï¥…à£³É’ç„ à©ƒà¡‹è€§â¿€ëš–í—‚ç½³å�”ä´Šç¼�ä—�èƒ¾ë‹œî€˜ç¦«æ‡²ë¡‚é´¢ë§†ä­ºä‹¶ã©“åœ†í²¶ëŽ„ì�ªí®„ä‹ é´©åŠ¥ì½±é›…å‡•ã« ï·§îº å°•ë‘—í¶¼ì€—î‡©ã» ä��鞪觗î·�ì�¶ïŒ¼ë« ᭵뫡롾Ὦë�œä®¤ê¬�ጓਔ欇å�„êƒ­â»£å°ƒê°‰ì¸ â� ⶨ؇⹒î¼�龲ｫ㣔ꃢäŠ�í’µç¹‘å˜‚ç©šá³‹å‹‘È·ï¹¦áš–âš¸æºƒà´¸ì®‡ä˜’ã¯¸æ„­â°®éƒƒê‘–ï›£ä²£Ý€ë› Ó®Å‚Û¿î–ªã€¸Infected with: Win32.Worm.Autorun.MF


Infected with: Win32.Worm.Autorun.MF

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3457)=>[Subject: Credit card transaction report][Date: Wed, 10 Sep 2008 10:43:54 +0100]=>(MIME part)=>Report.zip=>Report.doc 讣è� 옇ᬅ墰è�³à¦Œæ£¦áº‚ᗆ⑱æ�¸á˜±ç£®êŽ´ê�‹ê¸‰ã�„ꂽ⚋ቨ磱蘴ä�€ì¨¸áµ à±�鰽軰æ�¸á€šî‚†î·¢Ô­ì�’è—£æ�†í»�æ‘»áŠ‘æ™¨ç–„ç¨¡å†£á¢Žæ¼—Ú´î›¤ä‡¢âŠ¯ê‡ºï“±çš¬Þ á“�ç–�͆æ�¥É°ï¨®å »í›˜ë·�í¿¸é¨�혥臚通倡ì½�謙嶀塾ڼ虤ï�¶â�°ï† ë‚šã‘“í”�äŠ�溎歀밋옣á¯�ꃰâ�£à¼­é°¿ì„£ç·™äŠ‘î´‹î�Ší¬�Æ¡èœ�諒墆鮌뿆ޣå� 未䂔ë�Ÿë�ˆç»¨á¦˜ç‚†à«­â¡‘웓å�¨ï¬»ï®£å‡ªèž¨ã’¿å‚£ì‚”〹墧嘞äŠ�쒕舨캲á‘�î’ªì ¼í«¡å…¬ç’¨ë‚œí°¢á­¬ê¾¨â•£ìˆžì„©ï¥…à£³É’ç„ à©ƒà¡‹è€§â¿€ëš–í—‚ç½³å�”ä´Šç¼�ä—�èƒ¾ë‹œî€˜ç¦«æ‡²ë¡‚é´¢ë§†ä­ºä‹¶ã©“åœ†í²¶ëŽ„ì�ªí®„ä‹ é´©åŠ¥ì½±é›…å‡•ã« ï·§îº å°•ë‘—í¶¼ì€—î‡©ã» ä��鞪觗î·�ì�¶ïŒ¼ë« ᭵뫡롾Ὦë�œä®¤ê¬�ጓਔ欇å�„êƒ­â»£å°ƒê°‰ì¸ â� ⶨ؇⹒î¼�龲ｫ㣔ꃢäŠ�풵繑嘂穚᳋勑ȷ﹦ᚖ⚸溃സ쮇䘒㯸愭Ⱞ郃æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3457)=>[Subject: Credit card transaction report][Date: Wed, 10 Sep 2008 10:43:54 +0100]=>(MIME part)=>Report.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3457)=>[Subject: Credit card transaction report][Date: Wed, 10 Sep 2008 10:43:54 +0100]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3457)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3462)=>[Subject: I received a message from your bank ][Date: Wed, 10 Sep 2008 12:50:30 +0100]=>(MIME part)=>BANK_DETAILS.zip=>BANK_DETAI㛔Ⓢ䤊貅é¡�æ�“æ�¿á»˜å¤Žéˆ¾ã˜‹ê�“⫉ä�¸å½”㊕垸㱗䒿跖⚌쫀䧆鴼䪈좻੓魉㥳懷듽醿ꘪຄ⭫㉇厶í�µã ¶ä®·é„žç’ƒî®¢å°¹ê° 扎噂掙ê¸�筻î¢�ç‚¹æ›Œåµ¸ì’ƒå¸Šåµ›í°ƒî­½î—�䵣榒䅎엺誤앾ᯛ摡购馬ꔨ᪑ⴋâ�µâ—�è �ç�¯í„µáƒ±âºŒæ³Žê±´é¢‘ì�€ê“†ç±¦ì©™äŽ¶ë¥‡â—¼ä´ƒå’®î�’ᯈ予쉧ဦ軂勫ꈛ䥢玗硓⺻믄枒໢쥽ࣽåµ�홃蜘ꥲ⻯検䰌隌啴ൡ필ã�µì™©æŒ�îµ�飨栗풵╲瓱죸憭ϕí�¡é�–ï¬Šì ›ì³–ê²�㔳犲窒蘬髃ᤞáµ�ë‰–é‹–Ó»é•¾ï§€æŽ§ëˆªëºŸí¬¼à¸”á—§Ã±í¤’å´’æ²£ï¶»ë¯’ì¢‹å­šæ�Šë‘†é�Žï¥¿é™ƒä²©í¢¶ï†¹ä¿™í—Žë¥¤è±‰ê�«ï‡¤â›¥â’ªã�µâ®©í´·ã„”줣á�šå†¬â�¾é¬»å³žçµ�í€¢îš‘ï¥ºé¨¹é¸Œæ™­ì¾°ç„Œí°§íœ›í´šê‰›è•�褨稧á�·ê¶²ã�“徆䡟蹶閑ꤰ赵飔邩ì�±ë��â™–æ‘§ä­¼é©‰ë¿«ë–•ÜŸí­‰á ½íœ¶ãœ»ãˆ³ïž¨á­šë·µí½¨è¼Œâ£¯æ’·ì˜›å»˜å¾£ëœ æ¦¬è’�蹮倬✦悟Infected with: Trojan.Spy.ZBot.LB


Infected with: Trojan.Spy.ZBot.LB

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3462)=>[Subject: I received a message from your bank ][Date: Wed, 10 Sep 2008 12:50:30 +0100]=>(MIME part)=>BANK_DETAILS.zip=>BANK_DETAINK_DETAI㛔Ⓢ䤊貅é¡�æ�“æ�¿á»˜å¤Žéˆ¾ã˜‹ê�“⫉ä�¸å½”㊕垸㱗䒿跖⚌쫀䧆鴼䪈좻੓魉㥳懷듽醿ꘪຄ⭫㉇厶í�µã ¶ä®·é„žç’ƒî®¢å°¹ê° 扎噂掙ê¸�筻î¢�ç‚¹æ›Œåµ¸ì’ƒå¸Šåµ›í°ƒî­½î—�䵣榒䅎엺誤앾ᯛ摡购馬ꔨ᪑ⴋâ�µâ—�è �ç�¯í„µáƒ±âºŒæ³Žê±´é¢‘ì�€ê“†ç±¦ì©™äŽ¶ë¥‡â—¼ä´ƒå’®î�’ᯈ予쉧ဦ軂勫ꈛ䥢玗硓⺻믄枒໢쥽ࣽåµ�홃蜘ꥲ⻯検䰌隌啴ൡ필ã�µì™©æŒ�îµ�飨栗풵╲瓱죸憭ϕí�¡é�–ï¬Šì ›ì³–ê²�㔳犲窒蘬髃ᤞáµ�ë‰–é‹–Ó»é•¾ï§€æŽ§ëˆªëºŸí¬¼à¸”á—§Ã±í¤’å´’æ²£ï¶»ë¯’ì¢‹å­šæ�Šë‘†é�Žï¥¿é™ƒä²©í¢¶ï†¹ä¿™í—Žë¥¤è±‰ê�«ï‡¤â›¥â’ªã�µâ®©í´·ã„”줣á�šå†¬â�¾é¬»å³žçµ�í€¢îš‘ï¥ºé¨¹é¸Œæ™­ì¾°ç„Œí°§íœ›í´šê‰›è•�褨稧á�·ê¶²ã�“徆䡟蹶閑ꤰ赵飔邩ì�±ë��â™–æ‘§ä­¼é©‰ë¿«ë–•ÜŸí­‰á ½íœ¶ãœ»ãˆ³ïž¨á­šë·µí½¨è¼Œâ£¯æ’·æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3462)=>[Subject: I received a message from your bank ][Date: Wed, 10 Sep 2008 12:50:30 +0100]=>(MIME part)=>BANK_DETAILS.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3462)=>[Subject: I received a message from your bank ][Date: Wed, 10 Sep 2008 12:50:30 +0100]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3462)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3488)=>[Subject: Problems with delivery][Date:?Thu, 11 Sep 2008 14:57:21 +0000]=>(MIME part)=>ups_invoice.zip=>ups_invoice.exe


Infected with: Trojan.Spy.ZBot.LH

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3488)=>[Subject: Problems with delivery][Date:?Thu, 11 Sep 2008 14:57:21 +0000]=>(MIME part)=>ups_invoice.zip=>ups_invoice.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3488)=>[Subject: Problems with delivery][Date:?Thu, 11 Sep 2008 14:57:21 +0000]=>(MIME part)=>ups_invoice.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3488)=>[Subject: Problems with delivery][Date:?Thu, 11 Sep 2008 14:57:21 +0000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3488)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3489)=>[Subject: Reply: A report on radiation contamina][Date: Thu, 11 Sep 2008 20:31:51 -0600]=>(MIME part)=>victims.zip=>victims.exe


Infected with: Trojan.FakeAntivirus.Gen

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3489)=>[Subject: Reply: A report on radiation contamina][Date: Thu, 11 Sep 2008 20:31:51 -0600]=>(MIME part)=>victims.zip=>victims.exe


Disinfection failed

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3489)=>[Subject: Reply: A report on radiation contamina][Date: Thu, 11 Sep 2008 20:31:51 -0600]=>(MIME part)=>victims.zip=>victims.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3489)=>[Subject: Reply: A report on radiation contamina][Date: Thu, 11 Sep 2008 20:31:51 -0600]=>(MIME part)=>victims.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3489)=>[Subject: Reply: A report on radiation contamina][Date: Thu, 11 Sep 2008 20:31:51 -0600]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3489)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3507)=>[Subject: Statement of fees 2008/09][Date: Fri, 12 Sep 2008 20:50:16 -0500]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.


Infected with: Trojan.Spy.Agent.NYH

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3507)=>[Subject: Statement of fees 2008/09][Date: Fri, 12 Sep 2008 20:50:16 -0500]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.009.doc.


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3507)=>[Subject: Statement of fees 2008/09][Date: Fri, 12 Sep 2008 20:50:16 -0500]=>(MIME part)=>Fees_2008-2009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3507)=>[Subject: Statement of fees 2008/09][Date: Fri, 12 Sep 2008 20:50:16 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3507)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3517)=>[Subject: Permit for retirement][Date: Mon, 15 Sep 2008 08:30:01 +0000]=>(MIME part)=>contract_I1.zip=>contract_I1.doc.exe


Infected with: Win32.Worm.Autorun.MN

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3517)=>[Subject: Permit for retirement][Date: Mon, 15 Sep 2008 08:30:01 +0000]=>(MIME part)=>contract_I1.zip=>contract_I1.doc.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3517)=>[Subject: Permit for retirement][Date: Mon, 15 Sep 2008 08:30:01 +0000]=>(MIME part)=>contract_I1.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3517)=>[Subject: Permit for retirement][Date: Mon, 15 Sep 2008 08:30:01 +0000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3517)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3560)=>[Subject: Statement of fees 2008/09][Date:?Wed, 17 Sep 2008 21:41:52 +1200]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.Ϣꊰ퀲뭗㴜磿쎸ç½�㯎í�˜ížƒì½˜ï¡€ä±šî“´ï¬„鶣ì„�푆둎á�Žè�‰á––㘢â�¤é©•ë¯°ä–‰î¬µè„�尡맧ç�®Ø¯ì©ºêª�é±¥â½žìª¦ì Œë��âž‹ê‰�ꭥꉛëª�å’€é‘�ä ¦éš‰íœ›ïŽ�릒甌唌桀䎩䨣踮쌳丄﵀퀤芚匤â•�딗襢毚瓥ⶆ×ᖱ峓â§�祈嶅î�‰ë ®ç´‚ï§ ï…œâƒ¦â¿œè›‰á““ã£¾è©­è¾»î¡¬á´³âž„ï¡’á±Šê¤Žè”²ãª‡ä´‹ç£›ã°®âŽ–ç®ˆå…�é–²í˜ à¿¤è§Ÿè£�ᗟ៓矤ã�’à¯‚ê‡ ä‰�툂ä„�ᓵ茕胫Ã�ä‡ ÃŠçš®ã�€éšŒè†„î”Ÿã°¥ä’ â«•â°™ï�©å¬ºà´ƒá��ìš©çœ«ê–¢å‚‘í‹Šá ¡ï®¢àª„å°‰ê¤ˆê®œé†’åƒ¤å–µî¤¥èŒ­ï•�⭾ሼ狘ワᔪâ¿�ƃᛎ풩虀梈⵮⥉䄤îž�纤擼ꈽ逢å�†ï–«ê›¿à´�ఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌ뾌â¬�๰ٜ棎ಫ殀ë� 棙秔樀í¹�桗킳耑妯舓⭶⛴૲​ë�½æ²šç´€ì€‹ä¶½é°€í¼…턩놀î«±á“·ï±Ÿâ¿·éŒ‚ã¦•é¹­ì‹‚çªªä¬‘ï³¤éƒ–í²…á”¬è®šà®—ë«ªä¾”é�–䵵嶺⹛阜퉧Infected with: Trojan.Kobcka.FL


Infected with: Trojan.Kobcka.FL

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3560)=>[Subject: Statement of fees 2008/09][Date:?Wed, 17 Sep 2008 21:41:52 +1200]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.009.doc.Ϣꊰ퀲뭗㴜磿쎸ç½�㯎í�˜ížƒì½˜ï¡€ä±šî“´ï¬„鶣ì„�푆둎á�Žè�‰á––㘢â�¤é©•ë¯°ä–‰î¬µè„�尡맧ç�®Ø¯ì©ºêª�é±¥â½žìª¦ì Œë��âž‹ê‰�ꭥꉛëª�å’€é‘�ä ¦éš‰íœ›ïŽ�릒甌唌桀䎩䨣踮쌳丄﵀퀤芚匤â•�딗襢毚瓥ⶆ×ᖱ峓â§�祈嶅î�‰ë ®ç´‚ï§ ï…œâƒ¦â¿œè›‰á““ã£¾è©­è¾»î¡¬á´³âž„ï¡’á±Šê¤Žè”²ãª‡ä´‹ç£›ã°®âŽ–ç®ˆå…�é–²í˜ à¿¤è§Ÿè£�ᗟ៓矤ã�’à¯‚ê‡ ä‰�툂ä„�ᓵ茕胫Ã�ä‡ ÃŠçš®ã�€éšŒè†„î”Ÿã°¥ä’ â«•â°™ï�©å¬ºà´ƒá��ìš©çœ«ê–¢å‚‘í‹Šá ¡ï®¢àª„å°‰ê¤ˆê®œé†’åƒ¤å–µî¤¥èŒ­ï•�⭾ሼ狘ワᔪâ¿�ƃᛎ풩虀梈⵮⥉䄤îž�纤擼ꈽ逢å�†ï–«ê›¿à´�ఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌఌ뾌â¬�๰ٜ棎ಫ殀ë� 棙秔樀í¹�桗킳耑妯舓⭶⛴૲​ë�½æ²šç´€ì€‹ä¶½é°€í¼…턩놀î«±á“·ï±Ÿâ¿·éŒ‚ã¦•é¹­ì‹‚çªªä¬‘ï³¤éƒ–í²…á”¬è®šæ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3560)=>[Subject: Statement of fees 2008/09][Date:?Wed, 17 Sep 2008 21:41:52 +1200]=>(MIME part)=>Fees_2008-2009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3560)=>[Subject: Statement of fees 2008/09][Date:?Wed, 17 Sep 2008 21:41:52 +1200]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3560)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3719)=>[Subject: [NO-REPLY] UPS Tracking Number 3505530][Date: Mon, 29 Sep 2008 07:17:35 -0500]=>(MIME part)=>UPS_letter.zip=>UPS_letter㸵毲᫚욙☆裉뽽辞ê½�廒兰휾﨧ê·�⨻촉鄿உ㩑噄ⶾè«�塑벅㢑è–�å½µé�ªê——ᔗë¾�Ñ�â�±è²˜á–¶à¥‘ﳯ鶬怢뚾權컶ï�‡披턄ꅡᴘ鶂í‘�æ­�ë…»î�°â»±å™ˆçº·ï«–芮ä��ã°³è‘¹å“†È¾äš»ëšœí­”áƒ�蓑碕筻↯ナ륗貳노ﳡꈋ㑴雹é�–寉å—�㕒î��ï¨�⮊䞲é‚�é·�í†Šì´²áŸ¡áˆ•ç”·ÖŠç’…â¢„ã’·åšµä°£á—§á™¹à©ªé‰¦à †á­Šì��䶃ë—�莟ᖷã²�첢廜篩糢è‰�ïª¶çŸ ëº‡êŽ¯ä�·é‘‘é»�﫜心邅僘찞챓먥곈ؚ쮕答íŒ�ꥹ쇥é–�ë¾¥ï¦�⾟è�£ë�­ë˜�ã›�ۘ惛氛涃ධ솶ῶᛚè�‡Ã¶è€§ì�“퀮倂ᄜଚՌææ�¬â€…㘅å¼�å¤�é¹€íº£ç—–ëž¸ìŒ€á‚œà½ºÎ ~å —î°‹à¸€â”ƒâ—€àº à¥¸é®Œí‚�í¦Œá­ºî‚‹.ì�¤ä€·å€Žå°†å¨‡á†€ì�³ã€¶à ‹ã €ã«€Ì 髈랣ṱ럮êž�郀㯇ୠیè�¼ìƒ…â€ªä ‘ë¸‡ç¸…ä¨‚î«¦í¿§ç®‚æ€›à¼¾ì¦¡æ³€à क़֬ζ?ä‚…ç€¥î —ì˜€äŸŒà»ˆÃ°Ê–æ€’ç³«ì¶½ë¡œÊ—ä€µí€½à°�â�£Ä´Ö°Í¦ìƒ®Infected with: Win32.Worm.Autorun.MV


Infected with: Win32.Worm.Autorun.MV

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3719)=>[Subject: [NO-REPLY] UPS Tracking Number 3505530][Date: Mon, 29 Sep 2008 07:17:35 -0500]=>(MIME part)=>UPS_letter.zip=>UPS_letterS_letter㸵毲᫚욙☆裉뽽辞ê½�廒兰휾﨧ê·�⨻촉鄿உ㩑噄ⶾè«�塑벅㢑è–�å½µé�ªê——ᔗë¾�Ñ�â�±è²˜á–¶à¥‘ﳯ鶬怢뚾權컶ï�‡披턄ꅡᴘ鶂í‘�æ­�ë…»î�°â»±å™ˆçº·ï«–芮ä��ã°³è‘¹å“†È¾äš»ëšœí­”áƒ�蓑碕筻↯ナ륗貳노ﳡꈋ㑴雹é�–寉å—�㕒î��ï¨�⮊䞲é‚�é·�í†Šì´²áŸ¡áˆ•ç”·ÖŠç’…â¢„ã’·åšµä°£á—§á™¹à©ªé‰¦à †á­Šì��䶃ë—�莟ᖷã²�첢廜篩糢è‰�ïª¶çŸ ëº‡êŽ¯ä�·é‘‘é»�﫜心邅僘찞챓먥곈ؚ쮕答íŒ�ꥹ쇥é–�ë¾¥ï¦�⾟è�£ë�­ë˜�ã›�ۘ惛氛涃ධ솶ῶᛚè�‡Ã¶è€§ì�“퀮倂ᄜଚՌææ�¬â€…㘅å¼�å¤�é¹€íº£ç—–ëž¸ìŒ€á‚œà½ºÎ ~å —î°‹à¸€â”ƒâ—€àº à¥¸é®Œí‚�í¦Œá­ºî‚‹.ì�¤ä€·å€Žå°†å¨‡á†€ì�³ã€¶à ‹ã €ã«€Ì 髈랣ṱ럮êž�郀㯇ୠیè�¼ìƒ…â€ªä ‘ë¸‡ç¸…ä¨‚î«¦í¿§ç®‚æ€›à¼¾ì¦¡æ³€à क़֬ζ?ä‚…ç€¥î —ì˜€äŸŒà»ˆÃ°Ê–æ€’ç³«ì¶½æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3719)=>[Subject: [NO-REPLY] UPS Tracking Number 3505530][Date: Mon, 29 Sep 2008 07:17:35 -0500]=>(MIME part)=>UPS_letter.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3719)=>[Subject: [NO-REPLY] UPS Tracking Number 3505530][Date: Mon, 29 Sep 2008 07:17:35 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3719)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3906)=>[Subject: Statement of fees 2008/09][Date:?Fri, 10 Oct 2008 08:20:11 -0500]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.▅ᔲ盢ê�›ä–Žå�™ç½‹í‡„ś㆞缉彾ቾᅪᡅ蔞⩛å¬�ç” á��絸᾵á�¨ê–Ÿë‹ŽêŠ�ê�‰â”„⦼ꋶజ䊓쉑䰟ì�šå±�ç �죹庀⮉í–�ë�žé“¨é«Ží±€á ‡åš¶ä­§ï½½ï‡¾ï�€è²·á„²î«€í†™é©·ï½™ï§—í�®åœ‘í•™íª®ã®œä—Ÿí¾„çªŠá¿»â¦—á€²æ‘·â¶’é�€æ­¥ä³¢á¡µã¥“Ἦꃡìƒ�रí®�⹡絑Ԋ뙗ꛞãƒ�襨괊㒙奵î�¾à·£î„ 猟ᨳí�€ä¢�맷ᘀｌé�Ÿé‹šï€„ç€�ৡ诡䞄民⦢䩛梷̞ç£�횋諭ᘘé»�是⋻陀྿䄴ã„�ì·¨ã˜‚î¦‡ê²£ê“·Å–ç˜½í¸€âœ¦ã¾žì �í¤ƒê§²î’ ê†±æ³µè´·è…‡ä•¬ï™œæž„ë½…íž€â ªè¨¾æ�µä·‘ã�¿à²Žç¹”笓髗ⶉâ�»ç‡‘á“šá¦½á¿€â¸µÂ€î”¸â³´î¿žæ¦…á£©ê˜Œé¿¥å©£æ ·î††á¡¥á›¦ï‡»ïš„ì¡„ä§�ì§ƒä›¤è¼¥â±“ê¾‚äŒ—â–½â¸·í«®ì«ŽÒ‘æ£¦ç€”ï¿�ꑕ㇦ë�¢ä³Šé¾Ÿï’¶ê£ºî§ î‡¡á¿«èœ¨í»¼í¥”î°ªíµ’í¶�í©©ê«Šé¬œã‰›é¾„Í©à¥“ì³¤â£™á‹·ï¥£ã›²í¢²î’�뽋巹᣿㒼笫⦑娽圎ᜪ봟ϼ૨á��သ䊦ჾ네è�…┱憙뀶ꌻ閨ￋꀈInfected with: Win32.Worm.Autorun.NK


Infected with: Win32.Worm.Autorun.NK

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3906)=>[Subject: Statement of fees 2008/09][Date:?Fri, 10 Oct 2008 08:20:11 -0500]=>(MIME part)=>Fees_2008-2009.zip=>Fees_2008-2009.doc.009.doc.▅ᔲ盢ê�›ä–Žå�™ç½‹í‡„ś㆞缉彾ቾᅪᡅ蔞⩛å¬�ç” á��絸᾵á�¨ê–Ÿë‹ŽêŠ�ê�‰â”„⦼ꋶజ䊓쉑䰟ì�šå±�ç �죹庀⮉í–�ë�žé“¨é«Ží±€á ‡åš¶ä­§ï½½ï‡¾ï�€è²·á„²î«€í†™é©·ï½™ï§—í�®åœ‘í•™íª®ã®œä—Ÿí¾„çªŠá¿»â¦—á€²æ‘·â¶’é�€æ­¥ä³¢á¡µã¥“Ἦꃡìƒ�रí®�⹡絑Ԋ뙗ꛞãƒ�襨괊㒙奵î�¾à·£î„ 猟ᨳí�€ä¢�맷ᘀｌé�Ÿé‹šï€„ç€�ৡ诡䞄民⦢䩛梷̞ç£�횋諭ᘘé»�是⋻陀྿䄴ã„�ì·¨ã˜‚î¦‡ê²£ê“·Å–ç˜½í¸€âœ¦ã¾žì �í¤ƒê§²î’ ê†±æ³µè´·è…‡ä•¬ï™œæž„ë½…íž€â ªè¨¾æ�µä·‘ã�¿à²Žç¹”笓髗ⶉâ�»ç‡‘á“šá¦½á¿€â¸µÂ€î”¸â³´î¿žæ¦…á£©ê˜Œé¿¥å©£æ ·î††á¡¥á›¦ï‡»ïš„ì¡„ä§�ì§ƒä›¤è¼¥â±“ê¾‚äŒ—â–½â¸·í«®ì«ŽÒ‘æ£¦ç€”ï¿�ꑕ㇦ë�¢ä³Šé¾Ÿï’¶ê£ºî§ î‡¡á¿«èœ¨í»¼í¥”î°ªíµ’í¶�í©©ê«Šé¬œã‰›é¾„Í©à¥“ì³¤â£™á‹·ï¥£ã›²í¢²î’�뽋巹᣿㒼笫⦑娽圎ᜪ봟ϼ૨á��သ䊦ჾ네æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3906)=>[Subject: Statement of fees 2008/09][Date:?Fri, 10 Oct 2008 08:20:11 -0500]=>(MIME part)=>Fees_2008-2009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3906)=>[Subject: Statement of fees 2008/09][Date:?Fri, 10 Oct 2008 08:20:11 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3906)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3914)=>[Subject: [NO-REPLY] UPS Tracking Number 4630715][Date: Sun, 12 Oct 2008 15:51:50 -0700]=>(MIME part)=>UPS_Letter.zip=>UPS_Letter鲙욅â±�ä¿žç”�⠃ᵟï�¡ä�»ë›“釗䡤َㆩ黼鋷⚔愪ﲲ졘ç�ºå·§à®±îˆ’翬ﷴ⌅賮ã�¦ã™«ã‘�㑺踖㬼ì�¢ë¨Œî§¼ã¹�䯗魂哬䋈膤永ᰎ蟱輸颈Ӗç�»â¬¨ã—…î­¦ç»�à¯�ç¼’Ý�曽ï�¬è­¼äˆ¶ê“ˆç£—緤垉ê��쪾఼á ç„½å²‘é«¡êˆšã“ˆï¢ à¢œç¢“è‚�‼ӥî¹�ã¦žçž¢ï—°í¾´í£‹æ€–ä¶Ÿí¨£î¦ˆï¨˜á’�ç¬�ã��ᷚ俈é›�춭㾻㉔튎૓釵뺇語櫼ⲛ࿤ﺩï�¸è©€ä€�ã§Šï¶ ë¡©ç«µæšˆå¹±ì��ì�²åª¢ì¬–Ȩʈᾠè­�æ’¹ë¢¼Ó´é‡¸ë °å¨©á¼Ÿå°‘à¹³ì—�覎✚Ð�䈚Ϯ쥪ñ쟎냥æ�ºîŸžïŸ‡(â �﮼漢炙7㈄ﶃ햯᱒ç¹�䲄脭쀯ï�‚냓畔ꀎí€�ï�¡â�ªê¾ˆå™”è·€å³�마祶疶ì•�ç°šë�—è’“ë­Šî›¾ã™‹á €á­´ã½¿à¹¶è ™ì¨¼ç®�٧輀å´�ᡀ欵í³�왴슑㡄ᕓھ嫄㬳霚麥慾漦ꩣ埈闦낇脕ì‹�ç�»î™¨é²“ëŽ€é¶—ç«†í´¸î´£æ—ªï…¾â�³áµ�뢰騖郖á�žá°ŒäŽŸæž“뼬膰篴壽餷î¾�æ‘Ÿå°‡í³¢í…®ç¬­ç¸½ì’–äƒ¨ï¡ºInfected with: Trojan.Agent.AKOI


Infected with: Trojan.Agent.AKOI

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3914)=>[Subject: [NO-REPLY] UPS Tracking Number 4630715][Date: Sun, 12 Oct 2008 15:51:50 -0700]=>(MIME part)=>UPS_Letter.zip=>UPS_LetterS_Letter鲙욅â±�ä¿žç”�⠃ᵟï�¡ä�»ë›“釗䡤َㆩ黼鋷⚔愪ﲲ졘ç�ºå·§à®±îˆ’翬ﷴ⌅賮ã�¦ã™«ã‘�㑺踖㬼ì�¢ë¨Œî§¼ã¹�䯗魂哬䋈膤永ᰎ蟱輸颈Ӗç�»â¬¨ã—…î­¦ç»�à¯�ç¼’Ý�曽ï�¬è­¼äˆ¶ê“ˆç£—緤垉ê��쪾఼á ç„½å²‘é«¡êˆšã“ˆï¢ à¢œç¢“è‚�‼ӥî¹�ã¦žçž¢ï—°í¾´í£‹æ€–ä¶Ÿí¨£î¦ˆï¨˜á’�ç¬�ã��ᷚ俈é›�춭㾻㉔튎૓釵뺇語櫼ⲛ࿤ﺩï�¸è©€ä€�ã§Šï¶ ë¡©ç«µæšˆå¹±ì��ì�²åª¢ì¬–Ȩʈᾠè­�æ’¹ë¢¼Ó´é‡¸ë °å¨©á¼Ÿå°‘à¹³ì—�覎✚Ð�䈚Ϯ쥪ñ쟎냥æ�ºîŸžïŸ‡(â �﮼漢炙7㈄ﶃ햯᱒ç¹�䲄脭쀯ï�‚냓畔ꀎí€�ï�¡â�ªê¾ˆå™”è·€å³�마祶疶ì•�ç°šë�—è’“ë­Šî›¾ã™‹á €á­´ã½¿à¹¶è ™ì¨¼ç®�٧輀å´�ᡀ欵í³�왴슑㡄ᕓھ嫄㬳霚麥慾漦ꩣ埈闦낇脕ì‹�ç�»î™¨é²“ëŽ€é¶—ç«†í´¸î´£æ—ªï…¾â�³áµ�뢰騖郖á�žá°ŒäŽŸæž“뼬膰篴壽餷æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3914)=>[Subject: [NO-REPLY] UPS Tracking Number 4630715][Date: Sun, 12 Oct 2008 15:51:50 -0700]=>(MIME part)=>UPS_Letter.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3914)=>[Subject: [NO-REPLY] UPS Tracking Number 4630715][Date: Sun, 12 Oct 2008 15:51:50 -0700]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 3914)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4008)=>[Subject: admin Report 1/1/2008 - 10/1/2008.][Date: Mon, 20 Oct 2008 09:56:15 +0100]=>(MIME part)=>Statement1-10.zip=>Statement 1í¦ºé‰¬æ£’è»ªé´†è¢ ä¯´è¯—ï˜©ã‰œÌ£á›²ê·žè’¸â�°è·…ᗋㅄ霒í�¹êŠŽï��䰈ꗻ澋諵â�¤ç©‡æ”­ìŠ’ë€‰í¸”ã¬›ã€±ë©¢áŸªæž®æ“�ﳨ촰手䧻䲊쬪ã�ºà¨Œêƒ‚è˜ƒé»žç°¨êˆ°æ‡Šâ¼—ãŸ„éµ¤ï “ì“�͞䙉볋⠽鼊í�­ï¬�â•±ê³¸á·¤ê£ƒïƒ·æ™®è˜¢ì§°é´¹âˆ‡ã¾£î®¸ä½³í’¢é¯®çŽ®ë‡—ï‘‰ê— åˆ¹ìµŠè§¢î§Ÿé„Žè ªé¬»ã£¬í¡½ì…ªè²™á¾…æ”·ë”®æ­¤ê‘¶å��⨙楂䗖䬱휒婤ꉱé„�凃ㆾ弙î’�í²°ä»·â¾¢å´ªØ®â ¸ï¼´ã�˜Éˆï� æ‚¯×ˆæ—‰ã´ží¢˜â�—焥ç�‹âœ¯ä�žå�«á¶‹ä šë‡§î¿°æš�ᔆ躻耽奬☡틂淬喔ꭲ绫纉괹è�ºâ –㥥渒ᓈï�šâ�ˆé»–쪴ㆽ說쭌楑é�¦â—´ç€§àª¹î¬—죣胘ì�Šê†ºä¿Šì¯ªì¦€ì•¾ã™°â˜�邾節⩟胤娢浞푬Ⱗ弧ãំ꾑倽뢗ã�¡æ­«Ò½é³¶ê–ƒï›šå¸˜á¤¨ï°¿ã¿¤ìš—ὀ쯰娹ä²�岂⢺ㅮ雓䤺⬛錆嵆䚳矑쬨é†�ëž�⦣켉絆轚⣾ꉪî¤�硞蜃侒뜳î��⊟ᳶ蛸먱餬⤦ì¾�枓긼쫸脅᱈뒫넀Infected with: Trojan.Kobcka.GI


Infected with: Trojan.Kobcka.GI

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4008)=>[Subject: admin Report 1/1/2008 - 10/1/2008.][Date: Mon, 20 Oct 2008 09:56:15 +0100]=>(MIME part)=>Statement1-10.zip=>Statement 1tement 1í¦ºé‰¬æ£’è»ªé´†è¢ ä¯´è¯—ï˜©ã‰œÌ£á›²ê·žè’¸â�°è·…ᗋㅄ霒í�¹êŠŽï��䰈ꗻ澋諵â�¤ç©‡æ”­ìŠ’ë€‰í¸”ã¬›ã€±ë©¢áŸªæž®æ“�ﳨ촰手䧻䲊쬪ã�ºà¨Œêƒ‚è˜ƒé»žç°¨êˆ°æ‡Šâ¼—ãŸ„éµ¤ï “ì“�͞䙉볋⠽鼊í�­ï¬�â•±ê³¸á·¤ê£ƒïƒ·æ™®è˜¢ì§°é´¹âˆ‡ã¾£î®¸ä½³í’¢é¯®çŽ®ë‡—ï‘‰ê— åˆ¹ìµŠè§¢î§Ÿé„Žè ªé¬»ã£¬í¡½ì…ªè²™á¾…æ”·ë”®æ­¤ê‘¶å��⨙楂䗖䬱휒婤ꉱé„�凃ㆾ弙î’�í²°ä»·â¾¢å´ªØ®â ¸ï¼´ã�˜Éˆï� æ‚¯×ˆæ—‰ã´ží¢˜â�—焥ç�‹âœ¯ä�žå�«á¶‹ä šë‡§î¿°æš�ᔆ躻耽奬☡틂淬喔ꭲ绫纉괹è�ºâ –㥥渒ᓈï�šâ�ˆé»–쪴ㆽ說쭌楑é�¦â—´ç€§àª¹î¬—죣胘ì�Šê†ºä¿Šì¯ªì¦€ì•¾ã™°â˜�邾節⩟胤娢浞푬Ⱗ弧ãំ꾑倽뢗ã�¡æ­«Ò½é³¶ê–ƒï›šå¸˜á¤¨ï°¿ã¿¤ìš—ὀ쯰娹ä²�岂⢺ㅮ雓䤺⬛錆嵆䚳矑쬨é†�ëž�⦣켉絆轚⣾ꉪî¤�硞蜃侒뜳î��⊟ᳶ蛸먱餬æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4008)=>[Subject: admin Report 1/1/2008 - 10/1/2008.][Date: Mon, 20 Oct 2008 09:56:15 +0100]=>(MIME part)=>Statement1-10.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4008)=>[Subject: admin Report 1/1/2008 - 10/1/2008.][Date: Mon, 20 Oct 2008 09:56:15 +0100]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4008)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4027)=>[Subject: Tracking N 5505512361][Date: Tue, 21 Oct 2008 15:11:45 -0500]=>(MIME part)=>INVOICE_7761662.doc.rar=>INVOICE_7761662.doå°ˆà°Œî”Ÿá¾™æ®¾ä°™è˜½í¼¬êž•í”Žè�±áž‹å–¸éœ©í¿�苶蔫â„�ﳡ轳掔먓̃壯藰蔨໔鋼⸇◺࿔ธẽ￾å�¢ê…‘蜲僔徹귨췷໽å¼�ïˆ�á°³ïŒ�픲醟þ嵼螞î�¸ç¬Œï›½ä”¹å½¿è´­á–«å™Ÿê“�㯄î«�뵰釦䕣ã£�ê¤‘è‚”í¨¹ãœ¶;ãƒ¶æ²ªë«™ë½°ì–Šå·¦à¤ŒçŒ¾å žì€”è€˜Ý¾è‚½è©¥ì�«î´šç©«é‘®æµœå˜ è�ºî¦©è¦€á�Šì€¸è³¿á¹�븈á�¹ã°�â¤€ë €è¢”î„…á¶�랇⶞ᔷ݆㑠ᱞ'å¸ ïª‹ì‰¶é¼Žìµ¢â�—ë£Œã›‡â… ë€ºí€†ã´¨éŸ©à¯ å�¾äŒ±Ï–á••ê¿¶î °æŒ‡â¡�æˆ„à¯‚é–‰ï ªã …à´€æ‚»ï¡¡é™€ë˜·ä ‚ä€�ì”±á•�â�˜å´€ê��ï±²é›ˆí¡«ë¯¢ëœ¯Ï•îˆ­í»·éŽ¥ã¬¡âµ–ç¯¨Îƒæ¢£ëŸ�î¤´áœ¦ç¸ ï¢‡ç½¢ë²³è …î —å´¨å�¸ç‹�哼닰滆ê¦�辟飰ï�²ç’�ç«ží¿˜ÏŸèƒ¼ì¨¾å½¼ç³€ë†™é¼’å“¬à´œé€­â¼¾èŠ…æ’‰í¼ƒç¨‡â‘�溩æ”�㜄Ꞅï‹�∱⵭旗èŽ�뗗ꀑ콺꯱첿韵踷ᷲë�°ï±¼ãº„듆⟀즌픉ìµ�ç¿�èª�ᰀ譳侵ï�‡í°±ï™�â�—㟟歷ç�¯ãµˆÃ³æ¦ºInfected with: Trojan.Spy.ZBot.MM


Infected with: Trojan.Spy.ZBot.MM

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4027)=>[Subject: Tracking N 5505512361][Date: Tue, 21 Oct 2008 15:11:45 -0500]=>(MIME part)=>INVOICE_7761662.doc.rar=>INVOICE_7761662.do61662.doå°ˆà°Œî”Ÿá¾™æ®¾ä°™è˜½í¼¬êž•í”Žè�±áž‹å–¸éœ©í¿�苶蔫â„�ﳡ轳掔먓̃壯藰蔨໔鋼⸇◺࿔ธẽ￾å�¢ê…‘蜲僔徹귨췷໽å¼�ïˆ�á°³ïŒ�픲醟þ嵼螞î�¸ç¬Œï›½ä”¹å½¿è´­á–«å™Ÿê“�㯄î«�뵰釦䕣ã£�ê¤‘è‚”í¨¹ãœ¶;ãƒ¶æ²ªë«™ë½°ì–Šå·¦à¤ŒçŒ¾å žì€”è€˜Ý¾è‚½è©¥ì�«î´šç©«é‘®æµœå˜ è�ºî¦©è¦€á�Šì€¸è³¿á¹�븈á�¹ã°�â¤€ë €è¢”î„…á¶�랇⶞ᔷ݆㑠ᱞ'å¸ ïª‹ì‰¶é¼Žìµ¢â�—ë£Œã›‡â… ë€ºí€†ã´¨éŸ©à¯ å�¾äŒ±Ï–á••ê¿¶î °æŒ‡â¡�æˆ„à¯‚é–‰ï ªã …à´€æ‚»ï¡¡é™€ë˜·ä ‚ä€�ì”±á•�â�˜å´€ê��ï±²é›ˆí¡«ë¯¢ëœ¯Ï•îˆ­í»·éŽ¥ã¬¡âµ–ç¯¨Îƒæ¢£ëŸ�î¤´áœ¦ç¸ ï¢‡ç½¢ë²³è …î —å´¨å�¸ç‹�哼닰滆ê¦�辟飰ï�²ç’�ç«ží¿˜ÏŸèƒ¼ì¨¾å½¼ç³€ë†™é¼’å“¬à´œé€­â¼¾èŠ…æ’‰í¼ƒç¨‡â‘�溩æ”�㜄Ꞅï‹�∱⵭旗èŽ�뗗ꀑ콺꯱첿韵踷ᷲë�°ï±¼ãº„듆⟀즌픉ìµ�ç¿�èª�ᰀ譳侵ï�‡æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4027)=>[Subject: Tracking N 5505512361][Date: Tue, 21 Oct 2008 15:11:45 -0500]=>(MIME part)=>INVOICE_7761662.doc.rar


Update failed

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4076)=>[Subject: Admin Tracking][Date: Mon, 27 Oct 2008 08:47:10 -0400]=>(MIME part)=>Tracking_s10.08.zip=>Tracking_s10.08.doc 헣댖驙롤㞳퓑褱甩㈲é�˜á šä›‡è¢“物Ⰸè�°ë³ºçš¦àª£ã¯œè¦ˆá´©ê¯‚⡭跬姼ì‘�Ä¦í ¬ã¦žëƒ£è¾œé­³æ˜¯æŸŸê­ƒí‹Ÿá®•é ’å·“æ¼¦ç·�꯶鲹Ç�噢匎惯⻪ⓦ躉ᣰ駽잟甤ꑆ墕ã—�뢅㈹立㎑墡뺅䯪얋㫂콓䛜å‘�î‰¦î¼™æœ—åš±ã‰©î‘Ÿéª•î¨œâ”Œì”ƒíª¼ï¤�ᘹ鳯鹸僙棪滱쪘㖫ã�”뱛磣᫷ᬢ㒧澬㉆ç�³â•„á‡�胘᳟ã�™ë¦­ç��ç·®è‡…í¯§é“€ãœ¸æ¯«á­™æœµä¦¿å®ºåª¢ëˆ­ë‡ˆí“�躽湷ë�ªÈ¸ê¬‹ä�Žèš�똸〨ï�–꽎雦◗㪙㌴ตᎠ죯í�”駄箢讼虉á�£è‰±è—’ì¡±ìŒ·äœ¡å…Ÿî–‰åŒ¦é€²î¾©å¿´ì–ªí¬¯ï›‹ë¶²ï½¬ï›‹æ¯…ï­„á¾�äª€á» Å å¾œá¨§ë „æŒƒç¼€áˆ ï–˜ç–ºå³�埜㬃؀ࢸÔꀖヷ憢ᢀຘè�¨è˜�í�™î�¥à¡žÒœÂ®è�·èƒ‡ã®“㽑༘᷀„Ǔ逥ç°�滨ï½�胻샓î�•î€Žâ� ໪Čņ脓ꅈ徕ﮉæ�‚ë€…ï ™â ’ì¸…ãœƒÚ�é® é„‡ì�€â¿Šã·�é Œì°�阇궀ǀೠã�°àµ�ȼ硺ë�¢ï€‰ì�€åšžï„™â®¸ä–�ç‹€å� ã� Ñ�Ɣȿⴵ鶼ᎆInfected with: Trojan.Agent.AKUF


Infected with: Trojan.Agent.AKUF

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4076)=>[Subject: Admin Tracking][Date: Mon, 27 Oct 2008 08:47:10 -0400]=>(MIME part)=>Tracking_s10.08.zip=>Tracking_s10.08.doc 헣댖驙롤㞳퓑褱甩㈲é�˜á šä›‡è¢“物Ⰸè�°ë³ºçš¦àª£ã¯œè¦ˆá´©ê¯‚⡭跬姼ì‘�Ä¦í ¬ã¦žëƒ£è¾œé­³æ˜¯æŸŸê­ƒí‹Ÿá®•é ’å·“æ¼¦ç·�꯶鲹Ç�噢匎惯⻪ⓦ躉ᣰ駽잟甤ꑆ墕ã—�뢅㈹立㎑墡뺅䯪얋㫂콓䛜å‘�î‰¦î¼™æœ—åš±ã‰©î‘Ÿéª•î¨œâ”Œì”ƒíª¼ï¤�ᘹ鳯鹸僙棪滱쪘㖫ã�”뱛磣᫷ᬢ㒧澬㉆ç�³â•„á‡�胘᳟ã�™ë¦­ç��ç·®è‡…í¯§é“€ãœ¸æ¯«á­™æœµä¦¿å®ºåª¢ëˆ­ë‡ˆí“�躽湷ë�ªÈ¸ê¬‹ä�Žèš�똸〨ï�–꽎雦◗㪙㌴ตᎠ죯í�”駄箢讼虉á�£è‰±è—’ì¡±ìŒ·äœ¡å…Ÿî–‰åŒ¦é€²î¾©å¿´ì–ªí¬¯ï›‹ë¶²ï½¬ï›‹æ¯…ï­„á¾�äª€á» Å å¾œá¨§ë „æŒƒç¼€áˆ ï–˜ç–ºå³�埜㬃؀ࢸÔꀖヷ憢ᢀຘè�¨è˜�í�™î�¥à¡žÒœÂ®è�·èƒ‡ã®“㽑༘᷀„Ǔ逥ç°�滨ï½�胻샓î�•î€Žâ� ໪Čņ脓ꅈ徕ﮉæ�‚ë€…ï ™â ’ì¸…ãœƒÚ�é® é„‡ì�€â¿Šã·�é Œì°�阇궀ǀೠã�°àµ�ȼ硺ë�¢ï€‰ì�€åšžï„™â®¸æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4076)=>[Subject: Admin Tracking][Date: Mon, 27 Oct 2008 08:47:10 -0400]=>(MIME part)=>Tracking_s10.08.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4076)=>[Subject: Admin Tracking][Date: Mon, 27 Oct 2008 08:47:10 -0400]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4076)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4086)=>[Subject: Admin Instruction on Recovery ][Date: Tue, 28 Oct 2008 16:53:21 +0800]=>(MIME part)=>Account_instruction.zip=>Account_i뾫㜶ç®�ï¸…ì½±ê“½é©³êœ¿î¥Žá“Œê¶‡ï¯®ëª›ì· ã–¼ã� 튽ᔱ낃çŽ�ç®�ï·‚ï¹‰áŠ…è˜¯ì¿‘í»µè”—å‡Œè’Žá¨±ï³¿î€¡í�’蚫먳鎥묞鼪π૶궵ì•�籽즨ꋪ嚈ì�¶î²½é��串浡אַ룪å®�⺦ⷀ帮槺潧㄄䚹纬훼녜㽟꯷晽㻤ᳺ뒡乡땼é�§éœ¾îŒ•ê‰žì“²ì®™è‰�îª„ëš‚ç´œêŒ ì¡­í ¹ç£ŠïœŸäŸ‹çœ¥í–³è’—é¯�⢨å�´æ¸¿â¢£î£¬ê©žê³ªì®¬æ‘�ç…�円軗Ꜻ필贾槑殑鴊á©�ï§§á¬šáƒ£ì³ƒà¹ºæ¨œæ­›éˆœì¤–è¹¹ç†‘í³ˆé±­ì�Ÿáª¦ë�‚隩疸㛚宓ਖì�«â�ªç…ší°�åª²ìº›í¯¾ä—”ä°Žì—�å•�ï–¹æ�‰î„¨ïœ¡ë²¹î‘›åƒ¸éŠ¦æ“�㜕åŽ�ìž˜ëƒºëŠ¶ïŒ„ê±¹î©ºá³»î¿Ží²µã’²êª¡åª³æ�«æ®˜îŒˆè¥œã¥”å—�嬛푳竼万뜄ꦚ쎪꘎호⧅ê£�ꨑí­�ê¿«ìŸ½ï¤ªïš«ë¶ªê½ªë¿šã«•â—µßªÉ¸è„“ì‚™ì€‡â€²í •á°…à¨€åŠ€æ» ï�Ÿí¬¾ï�·×‚Άä�¾ã€¨è ‡áˆ�á’�Í ×°á�°ßˆÅŠå€�á …ã‡Ÿî«‹è¿’à·ˆË è†£速ì¤�â©€à¶°à«¸à ¸ÜœÙ¾ï¯Šïž™ì”¿îŽ“ä¾Žê�ˆï€»î€®ä°�î˜†äˆ€Ä à¥˜Æ¤_Infected with: Trojan.Agent.AKVO


Infected with: Trojan.Agent.AKVO

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4086)=>[Subject: Admin Instruction on Recovery ][Date: Tue, 28 Oct 2008 16:53:21 +0800]=>(MIME part)=>Account_instruction.zip=>Account_iccount_i뾫㜶ç®�ï¸…ì½±ê“½é©³êœ¿î¥Žá“Œê¶‡ï¯®ëª›ì· ã–¼ã� 튽ᔱ낃çŽ�ç®�ï·‚ï¹‰áŠ…è˜¯ì¿‘í»µè”—å‡Œè’Žá¨±ï³¿î€¡í�’蚫먳鎥묞鼪π૶궵ì•�籽즨ꋪ嚈ì�¶î²½é��串浡אַ룪å®�⺦ⷀ帮槺潧㄄䚹纬훼녜㽟꯷晽㻤ᳺ뒡乡땼é�§éœ¾îŒ•ê‰žì“²ì®™è‰�îª„ëš‚ç´œêŒ ì¡­í ¹ç£ŠïœŸäŸ‹çœ¥í–³è’—é¯�⢨å�´æ¸¿â¢£î£¬ê©žê³ªì®¬æ‘�ç…�円軗Ꜻ필贾槑殑鴊á©�ï§§á¬šáƒ£ì³ƒà¹ºæ¨œæ­›éˆœì¤–è¹¹ç†‘í³ˆé±­ì�Ÿáª¦ë�‚隩疸㛚宓ਖì�«â�ªç…ší°�åª²ìº›í¯¾ä—”ä°Žì—�å•�ï–¹æ�‰î„¨ïœ¡ë²¹î‘›åƒ¸éŠ¦æ“�㜕åŽ�ìž˜ëƒºëŠ¶ïŒ„ê±¹î©ºá³»î¿Ží²µã’²êª¡åª³æ�«æ®˜îŒˆè¥œã¥”å—�嬛푳竼万뜄ꦚ쎪꘎호⧅ê£�ꨑí­�ê¿«ìŸ½ï¤ªïš«ë¶ªê½ªë¿šã«•â—µßªÉ¸è„“ì‚™ì€‡â€²í •á°…à¨€åŠ€æ» ï�Ÿí¬¾ï�·×‚Άä�¾ã€¨è ‡áˆ�á’�Í ×°á�°ßˆÅŠå€�á …ã‡Ÿî«‹è¿’à·ˆË è†£速ì¤�â©€à¶°à«¸à ¸ÜœÙ¾ï¯Šïž™ì”¿îŽ“ä¾Žæ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4086)=>[Subject: Admin Instruction on Recovery ][Date: Tue, 28 Oct 2008 16:53:21 +0800]=>(MIME part)=>Account_instruction.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4086)=>[Subject: Admin Instruction on Recovery ][Date: Tue, 28 Oct 2008 16:53:21 +0800]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4086)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4113)=>[Subject: Your Tracking # 30136510 (NO-REPLY)][Date: Wed, 29 Oct 2008 08:04:51 -0500]=>(MIME part)=>Inv#3982.zip=>Inv#3982.doc 慘ᓧé£�禕㞄⧛꘭貯ì�«å¨…á–—î‹§æ¬ í—ªç»«å¢­æ�™â´…簢鯣ᆒɞí�¸ì¾˜é°»èœ»á½’菱ᒲé�’ë‡»í¼•çœ¹è¡¡çŸ£ë Žï’ŽæŠ”ãš™ì³ƒä¹±â¬Ÿà¡¿í�¦çŽ�锳칔猞ä�¸é»³ã±˜ê¹œí——ì‚Šê¬“Ú»ê¹¹æ£­ï¥“áœ»æº—í¯Žä¤¤êŽªè�¹á¸„戅൅廣後鸼郣뚋㘶ᔱ롹ㇺé�¢Üªî›–ä­¯â­Ÿì‹ á®„é²·ï†žã�Œè²¾ç†‹í ›é­¸ìƒ¥ä±³á‰‡î§�ë·Ÿá�¦ï�¤êŸºå°‡å†¸î§²è¿™â�·å´¯ëª„ਇ紅ç€�æƒ„í©ˆê¿™Þºë��䩽꘦ს㖣í�Žå“´ç‘‰ë�·à¾ºá—”Õ¼è²Ÿì‘ ï¡¡å¢®ê�Žî¶±çž™æ®§é¤�誩ã®�í¢´èŒ¡ì°”á»®äšŒî„°í‹¹éº¾ç�„é‹—î«®ç—¬é¼°Ú‰ã‡¥ã±°ç¡´âŒ›é¤„ã°†è ¾ç�¹ê��ᔇᲜä™�抓䨦匱ê�«îŸ¸é©�ç¼»æ¥�î²›ä“¥íœ¹ä’‹ê» ì„“æ‹¬é¸ ï³‹ä‹´íŒ…æ…¥í‡’ê°¿æ–†ï©¼á­£â½Œæ§…å¦šé®ˆçŸ î±²âµ¸è¥«æˆžå•šêˆ„á«ªí‹³ë¥‚æ‰–ï“©ã°»æ——ï†Œë�‚ꤜㅸ樥蟄럊瓨唢臃踲媟秴ዑ싒쩿᳌뢞봻潻࿠â·�拲開Ϳä�“꫆ï‹�à·„ï¤–à³•ï‚·æ·»çŸ´ëˆ¥ï‚¢í¼©è¯¶è°¢åº¯í‰²î·©í ¤á¤½è—ƒë““æ£¹Infected with: Trojan.Kobcka.GO


Infected with: Trojan.Kobcka.GO

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4113)=>[Subject: Your Tracking # 30136510 (NO-REPLY)][Date: Wed, 29 Oct 2008 08:04:51 -0500]=>(MIME part)=>Inv#3982.zip=>Inv#3982.doc 2.doc 慘ᓧé£�禕㞄⧛꘭貯ì�«å¨…á–—î‹§æ¬ í—ªç»«å¢­æ�™â´…簢鯣ᆒɞí�¸ì¾˜é°»èœ»á½’菱ᒲé�’ë‡»í¼•çœ¹è¡¡çŸ£ë Žï’ŽæŠ”ãš™ì³ƒä¹±â¬Ÿà¡¿í�¦çŽ�锳칔猞ä�¸é»³ã±˜ê¹œí——ì‚Šê¬“Ú»ê¹¹æ£­ï¥“áœ»æº—í¯Žä¤¤êŽªè�¹á¸„戅൅廣後鸼郣뚋㘶ᔱ롹ㇺé�¢Üªî›–ä­¯â­Ÿì‹ á®„é²·ï†žã�Œè²¾ç†‹í ›é­¸ìƒ¥ä±³á‰‡î§�ë·Ÿá�¦ï�¤êŸºå°‡å†¸î§²è¿™â�·å´¯ëª„ਇ紅ç€�æƒ„í©ˆê¿™Þºë��䩽꘦ს㖣í�Žå“´ç‘‰ë�·à¾ºá—”Õ¼è²Ÿì‘ ï¡¡å¢®ê�Žî¶±çž™æ®§é¤�誩ã®�í¢´èŒ¡ì°”á»®äšŒî„°í‹¹éº¾ç�„é‹—î«®ç—¬é¼°Ú‰ã‡¥ã±°ç¡´âŒ›é¤„ã°†è ¾ç�¹ê��ᔇᲜä™�抓䨦匱ê�«îŸ¸é©�ç¼»æ¥�î²›ä“¥íœ¹ä’‹ê» ì„“æ‹¬é¸ ï³‹ä‹´íŒ…æ…¥í‡’ê°¿æ–†ï©¼á­£â½Œæ§…å¦šé®ˆçŸ î±²âµ¸è¥«æˆžå•šêˆ„á«ªí‹³ë¥‚æ‰–ï“©ã°»æ——ï†Œë�‚ꤜㅸ樥蟄럊瓨唢臃踲媟秴ዑ싒쩿᳌뢞봻潻࿠â·�拲開Ϳä�“꫆ï‹�à·„ï¤–à³•ï‚·æ·»çŸ´ëˆ¥ï‚¢í¼©æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4113)=>[Subject: Your Tracking # 30136510 (NO-REPLY)][Date: Wed, 29 Oct 2008 08:04:51 -0500]=>(MIME part)=>Inv#3982.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4113)=>[Subject: Your Tracking # 30136510 (NO-REPLY)][Date: Wed, 29 Oct 2008 08:04:51 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4113)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4156)=>[Subject: Account Operations Report][Date: Sat, 1 Nov 2008 07:43:43 -0600]=>(MIME part)=>Statment_details.zip=>Statment_details.dä­±áºŠëŽ¤ã„‰ã ­åŸ‹íž¨ë¶“í§“â´¯é‰‘æ¥€îŒ²é«¼æ€¡ã¥¥ãœŸê”±é�µê²�ì“†ê’«ê…Ÿâž‡î»»í®¼è’±èž¹ì¦¦ë®¿âŒ¹ãž±å¹µæŽ³à­™â¤´Ú§ëƒŽèŸ“æ˜–ï¶’å¤©è£¡ï«‹êšŽë�Ÿë¦¤ä·¹î©£ç”ªë‹–ï©�í²Œé¢�嶡꼥ጤ꺔앧à¿�矜é�¨â”‹å½Ÿãž«ã‰šæ›¨è��ì¸«ç¤¤á©˜á–ªä¥²á„¢ç¥¥ã•®îƒŽç¾ªå ³ãž€åŠ�㸿í�´á�¥å˜¢é›”ëŒŸä—¼ì­¦å–…é‹Šè¸µã‰–æ«³ì¦¡ã–€å´ ã�Šì…¾í¼­éµ�째캮ꅘ銜ᄭ㦅î�‹ï¹›ä¶’è’Šê´¦î¶¼ï¯´í²§è ‹á¤±ë¯ªé¿–î‘´ã–†â¢”ë“‹å¿Œê¬£ã�³î®­Ð¦â¬™ä�¬ë�¾ç›¢îŸ‘꣈츽瓽ã��ì†ªæ¾ á–¯ä‰±îº¯å—Žå®£å™ªè‚¤ë§¶î«•çž³èœ¢ï™·æ¹†è¼®â£ ä†»ë¶¬î‡ƒç´‘ç�‡éªºê¥‰êŠ†ê˜Œíšœè„—褓ㄢᬖ홢芼ê�¼ë‡‰Ôšè½Ÿä¡ ꪮ᭼ç��凊♶å˜�ⴹ뾺樅픫깋眲抣듴౳휳﮹嬬峛躞ꌗ㕌ⳗ墿찮槶쩮㭟ä’�ã�µî›¨é‚˜á¿Œé”£å»‚ᇳ媯檳ⶶå�·ãŸ©ç¨³â±­ë”¸ï”¾ï‰�໶ï�«ä¤§à­Ÿå•¡ê§…ä…˜å¯®ç„¯í­—æ«�阺Û�谖绯é”�꒙䦷å�ªê¾¦ç©¥æ�·ê¥£ä£“疘㧱鲃ꨦ蒹î�·íŸ´ç‰‘㘣谾á�¶Infected with: Trojan.Kobcka.GV


Infected with: Trojan.Kobcka.GV

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4156)=>[Subject: Account Operations Report][Date: Sat, 1 Nov 2008 07:43:43 -0600]=>(MIME part)=>Statment_details.zip=>Statment_details.details.dä­±áºŠëŽ¤ã„‰ã ­åŸ‹íž¨ë¶“í§“â´¯é‰‘æ¥€îŒ²é«¼æ€¡ã¥¥ãœŸê”±é�µê²�ì“†ê’«ê…Ÿâž‡î»»í®¼è’±èž¹ì¦¦ë®¿âŒ¹ãž±å¹µæŽ³à­™â¤´Ú§ëƒŽèŸ“æ˜–ï¶’å¤©è£¡ï«‹êšŽë�Ÿë¦¤ä·¹î©£ç”ªë‹–ï©�í²Œé¢�嶡꼥ጤ꺔앧à¿�矜é�¨â”‹å½Ÿãž«ã‰šæ›¨è��ì¸«ç¤¤á©˜á–ªä¥²á„¢ç¥¥ã•®îƒŽç¾ªå ³ãž€åŠ�㸿í�´á�¥å˜¢é›”ëŒŸä—¼ì­¦å–…é‹Šè¸µã‰–æ«³ì¦¡ã–€å´ ã�Šì…¾í¼­éµ�째캮ꅘ銜ᄭ㦅î�‹ï¹›ä¶’è’Šê´¦î¶¼ï¯´í²§è ‹á¤±ë¯ªé¿–î‘´ã–†â¢”ë“‹å¿Œê¬£ã�³î®­Ð¦â¬™ä�¬ë�¾ç›¢îŸ‘꣈츽瓽ã��ì†ªæ¾ á–¯ä‰±îº¯å—Žå®£å™ªè‚¤ë§¶î«•çž³èœ¢ï™·æ¹†è¼®â£ ä†»ë¶¬î‡ƒç´‘ç�‡éªºê¥‰êŠ†ê˜Œíšœè„—褓ㄢᬖ홢芼ê�¼ë‡‰Ôšè½Ÿä¡ ꪮ᭼ç��凊♶å˜�ⴹ뾺樅픫깋眲抣듴౳휳﮹嬬峛躞ꌗ㕌ⳗ墿찮槶쩮㭟ä’�ã�µî›¨é‚˜á¿Œé”£å»‚ᇳ媯檳ⶶå�·ãŸ©ç¨³â±­ë”¸ï”¾ï‰�໶ï�«ä¤§à­Ÿå•¡ê§…ä…˜å¯®ç„¯í­—æ«�阺Û�谖绯é”�꒙䦷å�ªê¾¦ç©¥æ�·ê¥£ä£“疘㧱æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4156)=>[Subject: Account Operations Report][Date: Sat, 1 Nov 2008 07:43:43 -0600]=>(MIME part)=>Statment_details.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4156)=>[Subject: Account Operations Report][Date: Sat, 1 Nov 2008 07:43:43 -0600]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4156)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4226)=>[Subject: Your Tracking # 0512862514][Date: Fri, 7 Nov 2008 16:12:50 -0500]=>(MIME part)=>UPSInvoice_8766155.zip=>UPSInvoice_8766ï��룵ⱪå›�ï ¾ë� 奄忽Ḗꕯ먕ꮢ龗嬤냵휮닰ë��ᦱ踧谕ꦎé�Œã¡”æ­­â¿¨ã†ªà¨–í¶µãŸ´äª…å­Žç¥¶ã�±âœ£æ¯¨é–µåŠ—é•—æ·¨ï²„æŠ—ë¦®í¨Œè¼ƒé¨§è¤ºá¡®æ¢†ê¸«ë®¿äŒ±å½¿é°ªà®²å¸µê‹ží˜¯è°½é’›â›Žé¨‘ì©¡ì°�錛ࡆ㭂釮塖듨î�¤ÝŽè˜˜æ¡…潯┛旺鵼ׇâ�­çˆ–鳚íµ�㱺馉â�“᥷ê�‘윽煟䮰í¥�ì¤­ë˜Ÿî«›êª¹ä‹‹éœ¹Ì¶åˆ­á“—å‚Žì­¨ë—§ë¡¼å‘†â‡¥å¤ˆã‰­äª”í¿¥àªªë¦µé°§æž¶ã·ªï¢°ì±¹ï¶§êˆ±ï¹�ì’šë °ê«ªäŠ¾ç¹›ë½‰ê£¨ë�Žæ©»ë“ ã®·í¹´î— ï†™î˜Žå·ƒæ¶µî†™á‹‘é€¹ä§‹ìŽ³ì¶ƒì†¼éŽ„è•­æ¹¼ã�•ï¥­ì�ªæŒ¿ï¦¢é�­çˆ¼î«ƒâ«¾ãµ½Ò¿ë”¦îª™ãŽ¶ã«¿í¤’儙咎쩷ïº�즎릡à²�à ¶á—¼è´¦åµ’æ�¾å²®è–”î�»ê®‚댊秿è”�î”—ç¥…å¹‘áž”ä—¥å…¹é‘žî”—æ«¿î¸¹ï‘Šë £á¸‰æž€â¶ ä½¾Ý¶æ�Žï€€â„‚ã© è��뀓簃꛷余ì¸�ì‚·æ€£é¯›â®¨Õ°äƒƒé €æ�Œã¹ à£¸Í¬ä‚‡ë †ç¸€ã”�ë– ì¢ˆë°‘è˜…ì²‹âŽºé™±ç¢‚á‚°Ñ¼èˆ¶î€½ã ˜ï¸‡í°�å”‡ê– å„›î€—æ›¢ã¿®îœŠâ��ëŒ�à«�ᆰInfected with: Trojan.Spy.Wsnpoem.LF


Infected with: Trojan.Spy.Wsnpoem.LF

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4226)=>[Subject: Your Tracking # 0512862514][Date: Fri, 7 Nov 2008 16:12:50 -0500]=>(MIME part)=>UPSInvoice_8766155.zip=>UPSInvoice_8766ice_8766ï��룵ⱪå›�ï ¾ë� 奄忽Ḗꕯ먕ꮢ龗嬤냵휮닰ë��ᦱ踧谕ꦎé�Œã¡”æ­­â¿¨ã†ªà¨–í¶µãŸ´äª…å­Žç¥¶ã�±âœ£æ¯¨é–µåŠ—é•—æ·¨ï²„æŠ—ë¦®í¨Œè¼ƒé¨§è¤ºá¡®æ¢†ê¸«ë®¿äŒ±å½¿é°ªà®²å¸µê‹ží˜¯è°½é’›â›Žé¨‘ì©¡ì°�錛ࡆ㭂釮塖듨î�¤ÝŽè˜˜æ¡…潯┛旺鵼ׇâ�­çˆ–鳚íµ�㱺馉â�“᥷ê�‘윽煟䮰í¥�ì¤­ë˜Ÿî«›êª¹ä‹‹éœ¹Ì¶åˆ­á“—å‚Žì­¨ë—§ë¡¼å‘†â‡¥å¤ˆã‰­äª”í¿¥àªªë¦µé°§æž¶ã·ªï¢°ì±¹ï¶§êˆ±ï¹�ì’šë °ê«ªäŠ¾ç¹›ë½‰ê£¨ë�Žæ©»ë“ ã®·í¹´î— ï†™î˜Žå·ƒæ¶µî†™á‹‘é€¹ä§‹ìŽ³ì¶ƒì†¼éŽ„è•­æ¹¼ã�•ï¥­ì�ªæŒ¿ï¦¢é�­çˆ¼î«ƒâ«¾ãµ½Ò¿ë”¦îª™ãŽ¶ã«¿í¤’儙咎쩷ïº�즎릡à²�à ¶á—¼è´¦åµ’æ�¾å²®è–”î�»ê®‚댊秿è”�î”—ç¥…å¹‘áž”ä—¥å…¹é‘žî”—æ«¿î¸¹ï‘Šë £á¸‰æž€â¶ ä½¾Ý¶æ�Žï€€â„‚ã© è��뀓簃꛷余ì¸�ì‚·æ€£é¯›â®¨Õ°äƒƒé €æ�Œã¹ à£¸Í¬ä‚‡ë †ç¸€ã”�ë– ì¢ˆë°‘è˜…ì²‹âŽºé™±ç¢‚á‚°Ñ¼èˆ¶î€½ã ˜ï¸‡í°�唇æ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4226)=>[Subject: Your Tracking # 0512862514][Date: Fri, 7 Nov 2008 16:12:50 -0500]=>(MIME part)=>UPSInvoice_8766155.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4226)=>[Subject: Your Tracking # 0512862514][Date: Fri, 7 Nov 2008 16:12:50 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4226)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4257)=>[Subject: Permission for resignation][Date: Wed, 12 Nov 2008 06:01:17 -0500]=>(MIME part)=>Contract_N45.zip=>Contract_N45.doc 볆íŸ�櫺ݦ࿑ꚵ⹦䄱炻宧즲ꖹ﫛唬傗窹ë�­äºšå½–å…‰é«¦â… ê­´é“�î��䔷㎥닋Ø�ïªºã±«å©£ê±­é§šîª­ë¨‡îƒªã¨¨ê¾·ä­žåŒ½â·—ë™’ä ´ç«µåš§ç–µêª”áž�訳罛䨺䵵옙榤é”�ë‘�敵鬚唨è�³é²¾î¸®ëº«æ²¡î„ˆâŸˆé¬¨å‡ªí¥�旦毨퓽⇖茱ట諞弙ä¦�é””â®�ራä�€é¬©ëµ¿îžºïªªëŒ�å ½ê©Ÿî±®ë•�뤈⑙惼׃泃烓틧瘅é�”í«²î„�ï�¨âƒ¬ëº’ì°¶ç—�ä¦�å¸�屃好祚่ꬫ☥㠾ˤæ›�è²¾ë«�í’¬í©…ë°½é¶“é¹¤ä›Œï•‘ä–¤ï·”ë–Œé´¸ì»‰ì—¸å�›íµ†åµ¤å—–ï”±ì‹Šî“¤í¯¤ã…´éº¥ã©©×•ë‰¿ì¯ˆâª�æ ”â¼¦ã½”ç–¤î’–ì¿”æº¢ì ¬æ€–ê³¤åŒ¦î³�蒸鿜ꇵ晙ﱿî­�ᰶ敿胉쇔죹喜ë�ˆâ™™åš´ë“©æ†‘à¦ºíº´êš”è¸¶ä®ºè´—í·�闔Ⱋꥅ㱪컩餾峄純賙섪홤î�±ï¿§í¿—ê¼œî¯›ë«¶æº½í®¯ï›«ï¶ºæ´Ÿé²«ê��䤑불쾈꜑îœ�蔑⪈㷄å�„罄耗ࢡì�—ì�¤è¢›è£…è¡¥è‘¨ê„œî±„ê‘€ë¸ î‘‡á¢ºæ¥½í§±î¢„à±„ÌœÈ°è‡¡èž˜è‰˜èµ˜â��⊶â�¶äž¾è£�Infected with: Worm.Generic.55545


Infected with: Worm.Generic.55545

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4257)=>[Subject: Permission for resignation][Date: Wed, 12 Nov 2008 06:01:17 -0500]=>(MIME part)=>Contract_N45.zip=>Contract_N45.doc .doc 볆íŸ�櫺ݦ࿑ꚵ⹦䄱炻宧즲ꖹ﫛唬傗窹ë�­äºšå½–å…‰é«¦â… ê­´é“�î��䔷㎥닋Ø�ïªºã±«å©£ê±­é§šîª­ë¨‡îƒªã¨¨ê¾·ä­žåŒ½â·—ë™’ä ´ç«µåš§ç–µêª”áž�訳罛䨺䵵옙榤é”�ë‘�敵鬚唨è�³é²¾î¸®ëº«æ²¡î„ˆâŸˆé¬¨å‡ªí¥�旦毨퓽⇖茱ట諞弙ä¦�é””â®�ራä�€é¬©ëµ¿îžºïªªëŒ�å ½ê©Ÿî±®ë•�뤈⑙惼׃泃烓틧瘅é�”í«²î„�ï�¨âƒ¬ëº’ì°¶ç—�ä¦�å¸�屃好祚่ꬫ☥㠾ˤæ›�è²¾ë«�í’¬í©…ë°½é¶“é¹¤ä›Œï•‘ä–¤ï·”ë–Œé´¸ì»‰ì—¸å�›íµ†åµ¤å—–ï”±ì‹Šî“¤í¯¤ã…´éº¥ã©©×•ë‰¿ì¯ˆâª�æ ”â¼¦ã½”ç–¤î’–ì¿”æº¢ì ¬æ€–ê³¤åŒ¦î³�蒸鿜ꇵ晙ﱿî­�ᰶ敿胉쇔죹喜ë�ˆâ™™åš´ë“©æ†‘à¦ºíº´êš”è¸¶ä®ºè´—í·�闔Ⱋꥅ㱪컩餾峄純賙섪홤î�±ï¿§í¿—ê¼œî¯›ë«¶æº½í®¯ï›«ï¶ºæ´Ÿé²«ê��䤑불쾈꜑îœ�蔑⪈㷄å�„罄耗ࢡì�—ì�¤è¢›è£…è¡¥è‘¨ê„œî±„ê‘€ë¸ î‘‡á¢ºæ¥½í§±î¢„à±„Ìœæ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4257)=>[Subject: Permission for resignation][Date: Wed, 12 Nov 2008 06:01:17 -0500]=>(MIME part)=>Contract_N45.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4257)=>[Subject: Permission for resignation][Date: Wed, 12 Nov 2008 06:01:17 -0500]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4257)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4565)=>[Subject: UPS: Your Tracking # 003412724666][Date: Mon, 8 Dec 2008 07:57:19 +0100]=>(MIME part)=>ReIn86192.zip=>ReIn86192.exe


Infected with: Backdoor.Bot.68040

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4565)=>[Subject: UPS: Your Tracking # 003412724666][Date: Mon, 8 Dec 2008 07:57:19 +0100]=>(MIME part)=>ReIn86192.zip=>ReIn86192.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4565)=>[Subject: UPS: Your Tracking # 003412724666][Date: Mon, 8 Dec 2008 07:57:19 +0100]=>(MIME part)=>ReIn86192.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4565)=>[Subject: UPS: Your Tracking # 003412724666][Date: Mon, 8 Dec 2008 07:57:19 +0100]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4565)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4697)=>[Subject: UPS: Your Tracking # 743478777146][Date: Mon, 15 Dec 2008 12:50:46 -0600]=>(MIME part)=>DOC651221.zip=>DOC651221.exe


Infected with: Backdoor.Bot.68422

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4697)=>[Subject: UPS: Your Tracking # 743478777146][Date: Mon, 15 Dec 2008 12:50:46 -0600]=>(MIME part)=>DOC651221.zip=>DOC651221.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4697)=>[Subject: UPS: Your Tracking # 743478777146][Date: Mon, 15 Dec 2008 12:50:46 -0600]=>(MIME part)=>DOC651221.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4697)=>[Subject: UPS: Your Tracking # 743478777146][Date: Mon, 15 Dec 2008 12:50:46 -0600]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4697)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4975)=>[Subject: E-ticket #4081905962][Date: Tue, 13 Jan 2009 12:14:38 +0000]=>(MIME part)=>NorthwestAirlines.zip=>NorthwestAirlines.exe맋剄層漶韷橭谸鵦ጣä¤�曊é¤�橔졵ﺳ䊾噉쩕鲣鋕駲욧⿻皋绫耙豬我궢声᪌ì�‹è”±å¿µÄ¹å„ˆí¶�ᗜ䦺혧î‡�ë‹¯à ”ë�½æ­°ïˆ‘罜洉ï…�㯫咊ퟷ供쑒è£�藣㺊剳⾋䅢á�¶æœ�鈸î�¤à³²ã¬½à®±èŽ�귥䆰儻尴쫽明â�©çˆ�ɶ䴳ì�¡ãž¯å�ˆè¶œæ˜¨ë‹Žì¤®á¦“랙꒼﹅잒鴛â�“ä”¤å¨½åš­â“’ëŠžâ¥“ë®·è— î±ƒâ”³éŽ•ä§®ä­šå³©ë¤³á»�íŠ©ê©–êˆœâ¤¦ë˜»çš™íµ«åžºàª“ç–¥êµªà±›ë¥‰â¨‡äž½éœ¾é‘”çŠ¾ì�…믦î§�↟摰訣îº�ï•�즟뺙뗟ᑂæ�…铜著謢ì¾�柀둔뚴빡悥䋴é�©î¹šä—“輪횑é�«ï“©ê»ªä‚‚ã‘·í®”å…ˆî©�â¤¦í·“á¶´ï¤Œã¶¼ážŠã·¤ì¬±ê“”èºžë¥¨ã‘»á°¼ä§§í‘¥â•�쉭鸸뒇Ӏᮞ㠋ê�‡ï¼›äŸ‡è†Šæ�ŒÌ ì ™Ù€é€²ïº�䥧笘ꎜë¦�æ¿…ãŸ�í¼�ç¶¸î›‹í¥¨î¼®á³²ç®§ä¬·ìŸ¯íª‡à°–ä§“è¬µé¦ í²‘áš½ì¼�ä‚©ê��觖ҿ졀蟺ᴇ퀖軿哌᭴螡困˻à§�爰徆Ç�耎sè��hâ€�ê�€ë˜‚瘀縀鰄射￪è„�탇Infected with: Backdoor.Bot.72756


Infected with: Backdoor.Bot.72756

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4975)=>[Subject: E-ticket #4081905962][Date: Tue, 13 Jan 2009 12:14:38 +0000]=>(MIME part)=>NorthwestAirlines.zip=>NorthwestAirlines.exeines.exe맋剄層漶韷橭谸鵦ጣä¤�曊é¤�橔졵ﺳ䊾噉쩕鲣鋕駲욧⿻皋绫耙豬我궢声᪌ì�‹è”±å¿µÄ¹å„ˆí¶�ᗜ䦺혧î‡�ë‹¯à ”ë�½æ­°ïˆ‘罜洉ï…�㯫咊ퟷ供쑒è£�藣㺊剳⾋䅢á�¶æœ�鈸î�¤à³²ã¬½à®±èŽ�귥䆰儻尴쫽明â�©çˆ�ɶ䴳ì�¡ãž¯å�ˆè¶œæ˜¨ë‹Žì¤®á¦“랙꒼﹅잒鴛â�“ä”¤å¨½åš­â“’ëŠžâ¥“ë®·è— î±ƒâ”³éŽ•ä§®ä­šå³©ë¤³á»�íŠ©ê©–êˆœâ¤¦ë˜»çš™íµ«åžºàª“ç–¥êµªà±›ë¥‰â¨‡äž½éœ¾é‘”çŠ¾ì�…믦î§�↟摰訣îº�ï•�즟뺙뗟ᑂæ�…铜著謢ì¾�柀둔뚴빡悥䋴é�©î¹šä—“輪횑é�«ï“©ê»ªä‚‚ã‘·í®”å…ˆî©�â¤¦í·“á¶´ï¤Œã¶¼ážŠã·¤ì¬±ê“”èºžë¥¨ã‘»á°¼ä§§í‘¥â•�쉭鸸뒇Ӏᮞ㠋ê�‡ï¼›äŸ‡è†Šæ�ŒÌ ì ™Ù€é€²ïº�䥧笘ꎜë¦�æ¿…ãŸ�í¼�ç¶¸î›‹í¥¨î¼®á³²ç®§ä¬·ìŸ¯íª‡à°–ä§“è¬µé¦ í²‘áš½ì¼�ä‚©ê��觖ҿ졀蟺ᴇ퀖軿哌᭴螡困˻à§�爰徆Ç�耎sè��hæ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4975)=>[Subject: E-ticket #4081905962][Date: Tue, 13 Jan 2009 12:14:38 +0000]=>(MIME part)=>NorthwestAirlines.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4975)=>[Subject: E-ticket #4081905962][Date: Tue, 13 Jan 2009 12:14:38 +0000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 4975)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 5055)=>[Subject: Airline Reservations #4906518845][Date:?Mon, 19 Jan 2009 15:33:44 +0700]=>(MIME part)=>19012009.zip=>19012009.exe


Infected with: Trojan.FakeAntivirus.Gen

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 5055)=>[Subject: Airline Reservations #4906518845][Date:?Mon, 19 Jan 2009 15:33:44 +0700]=>(MIME part)=>19012009.zip=>19012009.exe


Disinfection failed

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 5055)=>[Subject: Airline Reservations #4906518845][Date:?Mon, 19 Jan 2009 15:33:44 +0700]=>(MIME part)=>19012009.zip=>19012009.exe


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 5055)=>[Subject: Airline Reservations #4906518845][Date:?Mon, 19 Jan 2009 15:33:44 +0700]=>(MIME part)=>19012009.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 5055)=>[Subject: Airline Reservations #4906518845][Date:?Mon, 19 Jan 2009 15:33:44 +0700]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox=>(message 5055)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Inbox


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\INBOXctrl-RCL.sbd\Ian=>(message 10)=>[Subject: E-ticket #4081905962][Date: Tue, 13 Jan 2009 12:14:38 +0000]=>(MIME part)=>NorthwestAirlines.zip=>Northwe맋剄層漶韷橭谸鵦ጣä¤�曊é¤�橔졵ﺳ䊾噉쩕鲣鋕駲욧⿻皋绫耙豬我궢声᪌ì�‹è”±å¿µÄ¹å„ˆí¶�ᗜ䦺혧î‡�ë‹¯à ”ë�½æ­°ïˆ‘罜洉ï…�㯫咊ퟷ供쑒è£�藣㺊剳⾋䅢á�¶æœ�鈸î�¤à³²ã¬½à®±èŽ�귥䆰儻尴쫽明â�©çˆ�ɶ䴳ì�¡ãž¯å�ˆè¶œæ˜¨ë‹Žì¤®á¦“랙꒼﹅잒鴛â�“ä”¤å¨½åš­â“’ëŠžâ¥“ë®·è— î±ƒâ”³éŽ•ä§®ä­šå³©ë¤³á»�íŠ©ê©–êˆœâ¤¦ë˜»çš™íµ«åžºàª“ç–¥êµªà±›ë¥‰â¨‡äž½éœ¾é‘”çŠ¾ì�…믦î§�↟摰訣îº�ï•�즟뺙뗟ᑂæ�…铜著謢ì¾�柀둔뚴빡悥䋴é�©î¹šä—“輪횑é�«ï“©ê»ªä‚‚ã‘·í®”å…ˆî©�â¤¦í·“á¶´ï¤Œã¶¼ážŠã·¤ì¬±ê“”èºžë¥¨ã‘»á°¼ä§§í‘¥â•�쉭鸸뒇Ӏᮞ㠋ê�‡ï¼›äŸ‡è†Šæ�ŒÌ ì ™Ù€é€²ïº�䥧笘ꎜë¦�æ¿…ãŸ�í¼�ç¶¸î›‹í¥¨î¼®á³²ç®§ä¬·ìŸ¯íª‡à°–ä§“è¬µé¦ í²‘áš½ì¼�ä‚©ê��觖ҿ졀蟺ᴇ퀖軿哌᭴螡困˻à§�爰徆Ç�耎sè��hâ€�ê�€ë˜‚瘀縀鰄射￪è„�탇Infected with: Backdoor.Bot.72756


Infected with: Backdoor.Bot.72756

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\INBOXctrl-RCL.sbd\Ian=>(message 10)=>[Subject: E-ticket #4081905962][Date: Tue, 13 Jan 2009 12:14:38 +0000]=>(MIME part)=>NorthwestAirlines.zip=>Northwe>Northwe맋剄層漶韷橭谸鵦ጣä¤�曊é¤�橔졵ﺳ䊾噉쩕鲣鋕駲욧⿻皋绫耙豬我궢声᪌ì�‹è”±å¿µÄ¹å„ˆí¶�ᗜ䦺혧î‡�ë‹¯à ”ë�½æ­°ïˆ‘罜洉ï…�㯫咊ퟷ供쑒è£�藣㺊剳⾋䅢á�¶æœ�鈸î�¤à³²ã¬½à®±èŽ�귥䆰儻尴쫽明â�©çˆ�ɶ䴳ì�¡ãž¯å�ˆè¶œæ˜¨ë‹Žì¤®á¦“랙꒼﹅잒鴛â�“ä”¤å¨½åš­â“’ëŠžâ¥“ë®·è— î±ƒâ”³éŽ•ä§®ä­šå³©ë¤³á»�íŠ©ê©–êˆœâ¤¦ë˜»çš™íµ«åžºàª“ç–¥êµªà±›ë¥‰â¨‡äž½éœ¾é‘”çŠ¾ì�…믦î§�↟摰訣îº�ï•�즟뺙뗟ᑂæ�…铜著謢ì¾�柀둔뚴빡悥䋴é�©î¹šä—“輪횑é�«ï“©ê»ªä‚‚ã‘·í®”å…ˆî©�â¤¦í·“á¶´ï¤Œã¶¼ážŠã·¤ì¬±ê“”èºžë¥¨ã‘»á°¼ä§§í‘¥â•�쉭鸸뒇Ӏᮞ㠋ê�‡ï¼›äŸ‡è†Šæ�ŒÌ ì ™Ù€é€²ïº�䥧笘ꎜë¦�æ¿…ãŸ�í¼�ç¶¸î›‹í¥¨î¼®á³²ç®§ä¬·ìŸ¯íª‡à°–ä§“è¬µé¦ í²‘áš½ì¼�ä‚©ê��觖ҿ졀蟺ᴇ퀖軿哌᭴螡困˻à§�爰徆Ç�耎sè��hæ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\INBOXctrl-RCL.sbd\Ian=>(message 10)=>[Subject: E-ticket #4081905962][Date: Tue, 13 Jan 2009 12:14:38 +0000]=>(MIME part)=>NorthwestAirlines.zip


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\INBOXctrl-RCL.sbd\Ian=>(message 10)=>[Subject: E-ticket #4081905962][Date: Tue, 13 Jan 2009 12:14:38 +0000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\INBOXctrl-RCL.sbd\Ian=>(message 10)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\INBOXctrl-RCL.sbd\Ian


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent=>(message 505)=>[Subject: [Fwd: E-ticket #4081905962]][Date: Tue, 13 Jan 2009 13:04:58 +0000]=>(MIME part)=>E-ticket #4081905962.eml=>[Subject: E-t맋剄層漶韷橭谸鵦ጣä¤�曊é¤�橔졵ﺳ䊾噉쩕鲣鋕駲욧⿻皋绫耙豬我궢声᪌ì�‹è”±å¿µÄ¹å„ˆí¶�ᗜ䦺혧î‡�ë‹¯à ”ë�½æ­°ïˆ‘罜洉ï…�㯫咊ퟷ供쑒è£�藣㺊剳⾋䅢á�¶æœ�鈸î�¤à³²ã¬½à®±èŽ�귥䆰儻尴쫽明â�©çˆ�ɶ䴳ì�¡ãž¯å�ˆè¶œæ˜¨ë‹Žì¤®á¦“랙꒼﹅잒鴛â�“ä”¤å¨½åš­â“’ëŠžâ¥“ë®·è— î±ƒâ”³éŽ•ä§®ä­šå³©ë¤³á»�íŠ©ê©–êˆœâ¤¦ë˜»çš™íµ«åžºàª“ç–¥êµªà±›ë¥‰â¨‡äž½éœ¾é‘”çŠ¾ì�…믦î§�↟摰訣îº�ï•�즟뺙뗟ᑂæ�…铜著謢ì¾�柀둔뚴빡悥䋴é�©î¹šä—“輪횑é�«ï“©ê»ªä‚‚ã‘·í®”å…ˆî©�â¤¦í·“á¶´ï¤Œã¶¼ážŠã·¤ì¬±ê“”èºžë¥¨ã‘»á°¼ä§§í‘¥â•�쉭鸸뒇Ӏᮞ㠋ê�‡ï¼›äŸ‡è†Šæ�ŒÌ ì ™Ù€é€²ïº�䥧笘ꎜë¦�æ¿…ãŸ�í¼�ç¶¸î›‹í¥¨î¼®á³²ç®§ä¬·ìŸ¯íª‡à°–ä§“è¬µé¦ í²‘áš½ì¼�ä‚©ê��觖ҿ졀蟺ᴇ퀖軿哌᭴螡困˻à§�爰徆Ç�耎sè��hâ€�ê�€ë˜‚瘀縀鰄射￪è„�탇Infected with: Backdoor.Bot.72756


Infected with: Backdoor.Bot.72756

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent=>(message 505)=>[Subject: [Fwd: E-ticket #4081905962]][Date: Tue, 13 Jan 2009 13:04:58 +0000]=>(MIME part)=>E-ticket #4081905962.eml=>[Subject: E-tect: E-t맋剄層漶韷橭谸鵦ጣä¤�曊é¤�橔졵ﺳ䊾噉쩕鲣鋕駲욧⿻皋绫耙豬我궢声᪌ì�‹è”±å¿µÄ¹å„ˆí¶�ᗜ䦺혧î‡�ë‹¯à ”ë�½æ­°ïˆ‘罜洉ï…�㯫咊ퟷ供쑒è£�藣㺊剳⾋䅢á�¶æœ�鈸î�¤à³²ã¬½à®±èŽ�귥䆰儻尴쫽明â�©çˆ�ɶ䴳ì�¡ãž¯å�ˆè¶œæ˜¨ë‹Žì¤®á¦“랙꒼﹅잒鴛â�“ä”¤å¨½åš­â“’ëŠžâ¥“ë®·è— î±ƒâ”³éŽ•ä§®ä­šå³©ë¤³á»�íŠ©ê©–êˆœâ¤¦ë˜»çš™íµ«åžºàª“ç–¥êµªà±›ë¥‰â¨‡äž½éœ¾é‘”çŠ¾ì�…믦î§�↟摰訣îº�ï•�즟뺙뗟ᑂæ�…铜著謢ì¾�柀둔뚴빡悥䋴é�©î¹šä—“輪횑é�«ï“©ê»ªä‚‚ã‘·í®”å…ˆî©�â¤¦í·“á¶´ï¤Œã¶¼ážŠã·¤ì¬±ê“”èºžë¥¨ã‘»á°¼ä§§í‘¥â•�쉭鸸뒇Ӏᮞ㠋ê�‡ï¼›äŸ‡è†Šæ�ŒÌ ì ™Ù€é€²ïº�䥧笘ꎜë¦�æ¿…ãŸ�í¼�ç¶¸î›‹í¥¨î¼®á³²ç®§ä¬·ìŸ¯íª‡à°–ä§“è¬µé¦ í²‘áš½ì¼�ä‚©ê��觖ҿ졀蟺ᴇ퀖軿哌᭴螡困˻à§�爰徆Ç�耎sè��hæ�„à –Deleted


Deleted

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent=>(message 505)=>[Subject: [Fwd: E-ticket #4081905962]][Date: Tue, 13 Jan 2009 13:04:58 +0000]=>(MIME part)=>E-ticket #4081905962.eml=>[Subject: E-t혧î‡�ë‹¯à ”ë�½æ­°ïˆ‘罜洉ï…�㯫咊ퟷ供쑒è£�藣㺊剳⾋䅢á�¶æœ�鈸î�¤à³²ã¬½à®±èŽ�귥䆰儻尴쫽明â�©çˆ�ɶ䴳ì�¡ãž¯å�ˆè¶œæ˜¨ë‹Žì¤®á¦“랙꒼﹅잒鴛â�“ä”¤å¨½åš­â“’ëŠžâ¥“ë®·è— î±ƒâ”³éŽ•ä§®ä­šå³©ë¤³á»�íŠ©ê©–êˆœâ¤¦ë˜»çš™íµ«åžºàª“ç–¥êµªà±›ë¥‰â¨‡äž½éœ¾é‘”çŠ¾ì�…믦î§�↟摰訣îº�ï•�즟뺙뗟ᑂæ�…铜著謢ì¾�柀둔뚴빡悥䋴é�©î¹šä—“輪횑é�«ï“©ê»ªä‚‚ã‘·í®”å…ˆî©�â¤¦í·“á¶´ï¤Œã¶¼ážŠã·¤ì¬±ê“”èºžë¥¨ã‘»á°¼ä§§í‘¥â•�쉭鸸뒇Ӏᮞ㠋ê�‡ï¼›äŸ‡è†Šæ�ŒÌ ì ™Ù€é€²ïº�䥧笘ꎜë¦�æ¿…ãŸ�í¼�ç¶¸î›‹í¥¨î¼®á³²ç®§ä¬·ìŸ¯íª‡à°–ä§“è¬µé¦ í²‘áš½ì¼�ä‚©ê��觖ҿ졀蟺ᴇ퀖軿哌᭴螡困˻à§�爰徆Ç�耎sè��hæ�„à –Deleted


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent=>(message 505)=>[Subject: [Fwd: E-ticket #4081905962]][Date: Tue, 13 Jan 2009 13:04:58 +0000]=>(MIME part)=>E-ticket #4081905962.eml=>[Subject: E-t혧î‡�ë‹¯à ”ë�½æ­°ïˆ‘罜洉ï…�㯫咊ퟷ供쑒è£�藣㺊剳⾋䅢á�¶æœ�鈸î�¤à³²ã¬½à®±èŽ�귥䆰儻尴쫽明â�©çˆ�ɶ䴳ì�¡ãž¯å�ˆè¶œæ˜¨ë‹Žì¤®á¦“랙꒼﹅잒鴛â�“ä”¤å¨½åš­â“’ëŠžâ¥“ë®·è— î±ƒâ”³éŽ•ä§®ä­šå³©ë¤³á»�íŠ©ê©–êˆœâ¤¦ë˜»çš™íµ«åžºàª“ç–¥êµªà±›ë¥‰â¨‡äž½éœ¾é‘”çŠ¾ì�…믦î§�↟摰訣îº�ï•�즟뺙뗟ᑂæ�…铜著謢ì¾�柀둔뚴빡悥䋴é�©î¹šä—“輪횑é�«ï“©ê»ªä‚‚ã‘·í®”å…ˆî©�â¤¦í·“á¶´ï¤Œã¶¼ážŠã·¤ì¬±ê“”èºžë¥¨ã‘»á°¼ä§§í‘¥â•�쉭鸸뒇Ӏᮞ㠋ê�‡ï¼›äŸ‡è†Šæ�ŒÌ ì ™Ù€é€²ïº�䥧笘ꎜë¦�æ¿…ãŸ�í¼�ç¶¸î›‹í¥¨î¼®á³²ç®§ä¬·ìŸ¯íª‡à°–ä§“è¬µé¦ í²‘áš½ì¼�ä‚©ê��觖ҿ졀蟺ᴇ퀖軿哌᭴螡困˻à§�爰徆Ç�耎sè��hæ�„à –Deleted


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent=>(message 505)=>[Subject: [Fwd: E-ticket #4081905962]][Date: Tue, 13 Jan 2009 13:04:58 +0000]=>(MIME part)=>E-ticket #4081905962.eml


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent=>(message 505)=>[Subject: [Fwd: E-ticket #4081905962]][Date: Tue, 13 Jan 2009 13:04:58 +0000]=>(MIME part)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent=>(message 505)


Updated

C:\Documents and Settings\Gemma_2\Application Data\Thunderbird\Profiles\sm0j38r3.default\Mail\Local Folders\Sent


Updated

======================================End of Scan Log===================================

Regards and thanks again.

Dene

Hi ridgedale,

Nice!

Quote

That's okay. BitDefender has run through the admin account profile (sm0j38r3.default) and disinfected/deleted all the problem emails. That profile only has 22,000+ files accessible.

Please run Kaspersky one more time just to be sure that we're clear.

Thanks