Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hijack This Log - Please Help Diagnose!


  • Please log in to reply
4 replies to this topic

#1 meowandme

meowandme

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:13 AM

Posted 29 August 2007 - 05:43 PM

My friend's computer was recently infected with the Vundo trojan. I had him download and run the Vundo removal tool and that appears to have gotten rid of the virus. He is still getting lots of popups so I had him download and run Spybot and Ad-Aware 2007. Those two programs found and cleaned a lot of spyware, however he continues to get some popups - not as many as before though. I had him run Hijack This and I'm attaching the log. Could someone please take a look and advise? He is running XP Home Edition.

Also, when he goes to his homepage, it loads the correct page, but there is a message at the top that reads: "The previous webpage may require the following add-on: 'pgrade Helper' from Real Networks, Inc. (unverified publisher)'. click here to allow to run.

Thank you!




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:31:36 PM, on 8/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\MICHAEL BIGGS\Application Data\Mozilla\Profiles\default\emqqto6c.slt\prefs.js)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://webmail.gdatp.com/iNotes.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.3.1_02) - http://kronos.wcs.k12.va.us/WFC/plugins/j2..._3_1_02-win.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_...outLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_...aploader_v6.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://webmail.gdatp.com/dwa7W.cab
O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://playgames.comcast.net/online2/mahjo...ameLauncher.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Security Center (wscsvc) - Unknown owner - C:\WINDOWS\C:\WINDOWS\System32\svchost.exe (file missing)

--
End of file - 9323 bytes

BC AdBot (Login to Remove)

 


#2 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:10:13 AM

Posted 30 August 2007 - 05:30 AM

Welcome to the BleepingComputer HijackThis Logs and Analysis forum meowandme :thumbsup:
My name is Richie and i'll be helping you to fix your problems.

Download SDFix.exe and save it to your desktop:
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

* Double click on SDFix on your desktop,and install the fix to C:\

Please then reboot your computer into Safe Mode by doing the following:

* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
* Instead of Windows loading as normal, a menu with options should appear;
* Select the first option, to run Windows in Safe Mode, then press "Enter".
* Choose your usual account.

* In Safe Mode,go to and open the C:\SDFix folder,then double click on RunThis.bat to start the script.
* Type Y to begin the script.
* It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
* Press any Key and it will restart the PC.
* Your system will take longer that normal to restart as the fixtool will be running and removing files.
* When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
* Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt into your next reply.

Download Combofix and save to your desktop:
Note:
It is important that it is saved directly to your desktop

Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the entire contents of C:\ComboFix.txt into your next reply.
Note:
Do not mouseclick combofix's window while it's running.
That may cause the program to freeze/hang.

Do NOT post the ComboFix-quarantined-files.txt unless I ask.

Now go to:
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
Right click on Hijackthis.exe and select 'Rename', rename it to abc.bat
Double click on abc.bat(which is still Hijackthis.exe),post that log into your next reply please.
Posted Image
Posted Image

#3 meowandme

meowandme
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:13 AM

Posted 03 September 2007 - 07:23 AM

Richie,

Here are the logs you asked for. Thanks so much for your help!!


Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found



Folder C:\Temp\fse - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0"
"C:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe"="C:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe:*:Disabled:pcAnywhere Host Service"
"C:\\Program Files\\Symantec\\pcAnywhere\\awrem32.exe"="C:\\Program Files\\Symantec\\pcAnywhere\\awrem32.exe:*:Disabled:pcAnywhere Remote Service"
"C:\\Documents and Settings\\Michael Biggs\\Local Settings\\Temporary Internet Files\\Content.IE5\\11IKA3IK\\incredimail_install[1].exe"="C:\\Documents and Settings\\Michael Biggs\\Local Settings\\Temporary Internet Files\\Content.IE5\\11IKA3IK\\incredimail_install[1].exe:*:Enabled:IncrediMail Installer"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
"C:\\WINDOWS\\system32\\dhimncpl.exe"="C:\\WINDOWS\\system32\\dhi"
"C:\\WINDOWS\\system32\\msipjwks.exe"="C:\\WINDOWS\\system32\\msi"
"C:\\WINDOWS\\system32\\liyfxnli.exe"="C:\\WINDOWS\\system32\\liy"
"C:\\WINDOWS\\system32\\nwsyshal.exe"="C:\\WINDOWS\\system32\\nws"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
---------------


Files with Hidden Attributes:

C:\Documents and Settings\Michael Biggs\NetHood\ca on teacherweb.com\Desktop.ini
C:\Documents and Settings\Michael Biggs\NetHood\SC on teacherweb.com\Desktop.ini
C:\Documents and Settings\Michael Biggs\NetHood\SC on www.teacherweb.com\Desktop.ini
C:\Program Files\Escape From Paradise\Escape.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Michael Biggs\My Documents\~WRL0005.tmp
C:\Documents and Settings\Michael Biggs\My Documents\~WRL0894.tmp
C:\Documents and Settings\Michael Biggs\My Documents\~WRL0987.tmp
C:\Documents and Settings\Michael Biggs\My Documents\~WRL1124.tmp
C:\Documents and Settings\Michael Biggs\My Documents\~WRL1190.tmp
C:\Documents and Settings\Michael Biggs\My Documents\~WRL1275.tmp
C:\Documents and Settings\Michael Biggs\My Documents\~WRL2293.tmp
C:\Documents and Settings\Michael Biggs\My Documents\~WRL3006.tmp
C:\Documents and Settings\Michael Biggs\My Documents\job\~WRL0001.tmp
C:\WINDOWS\SYSTEM32\qtstv.tmp

Finished


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:02 PM, on 8/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\abc.bat.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\MICHAEL BIGGS\Application Data\Mozilla\Profiles\default\emqqto6c.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: DWABrowserHlprObj Class - {2709D830-B643-4e72-9A1E-701CFFFCF30C} - C:\WINDOWS\system32\dwabho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://webmail.gdatp.com/iNotes.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.3.1_02) - http://kronos.wcs.k12.va.us/WFC/plugins/j2..._3_1_02-win.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_...outLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_...aploader_v6.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://webmail.gdatp.com/dwa7W.cab
O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://playgames.comcast.net/online2/mahjo...ameLauncher.cab
O20 - Winlogon Notify: xxyaaay - xxyaaay.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec Eraser Service (EraserSvc10732) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Security Center (wscsvc) - Unknown owner - C:\WINDOWS\C:\WINDOWS\System32\svchost.exe (file missing)

--
End of file - 9972 bytes


ComboFix 07-08-30.3 - "Michael Biggs" 2007-08-31 22:14:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.182 [GMT -4:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\f10WtR
C:\WINDOWS\SYSTEM32\qtstv.bak2
C:\WINDOWS\SYSTEM32\qtstv.ini
C:\WINDOWS\SYSTEM32\qtstv.ini2
C:\WINDOWS\SYSTEM32\qtstv.tmp
C:\WINDOWS\system32\vtstq.dll


((((((((((((((((((((((((( Files Created from 2007-08-01 to 2007-09-01 )))))))))))))))))))))))))))))))


2007-08-31 22:12 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-31 21:41 <DIR> d-------- C:\WINDOWS\ERUNT
2007-08-22 18:30 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-18 13:38 <DIR> d-------- C:\Program Files\Lavasoft
2007-08-18 13:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-18 13:33 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-18 13:29 <DIR> d-------- C:\DOCUME~1\MICHAE~1\APPLIC~1\Viewpoint
2007-08-16 19:04 <DIR> d-------- C:\Program Files\MSXML 4.0


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-31 21:16 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-08-31 17:49 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-08-26 20:26 --------- d-------- C:\DOCUME~1\MICHAE~1\APPLIC~1\AdobeUM
2007-08-26 16:09 --------- d-------- C:\Program Files\Quicken
2007-08-18 14:50 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-18 14:50 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-18 13:29 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
2007-08-18 13:10 --------- d-------- C:\Program Files\Google
2007-08-18 13:10 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-15 20:11 --------- d-------- C:\Program Files\FileZilla
2007-08-12 13:38 --------- d-------- C:\Program Files\Norton Internet Security
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\dllcache\wups.dll
2007-07-21 23:09 --------- d-------- C:\Program Files\Comcast Play Games
2007-07-21 22:27 --------- d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-07-19 02:59 3583488 --------- C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-16 07:50 --------- d-------- C:\DOCUME~1\MICHAE~1\APPLIC~1\Sandlot Games
2007-07-15 17:36 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
2007-07-13 15:17 83704 --a------ C:\WINDOWS\system32\dwabho.dll
2007-07-12 19:31 765952 --a------ C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-12 10:53 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Playtonium Games
2007-07-12 07:53 --------- d-------- C:\DOCUME~1\MICHAE~1\APPLIC~1\iWin
2007-07-11 20:58 --------- d-------- C:\Program Files\Palm
2007-07-11 07:58 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
2007-07-07 18:00 --------- d-------- C:\DOCUME~1\MICHAE~1\APPLIC~1\Wildfire
2007-07-02 22:17 --------- d-------- C:\Program Files\PlayFirst
2007-07-02 20:45 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Friends Games
2007-07-02 09:28 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
2007-07-02 09:27 --------- d-------- C:\DOCUME~1\MICHAE~1\APPLIC~1\PlayFirst
2007-06-27 10:34 823808 --------- C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 10:34 671232 --a------ C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 10:34 6058496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 10:34 52224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 10:34 477696 --------- C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 10:34 459264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 10:34 44544 --a------ C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 10:34 384512 --a------ C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 10:34 383488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 10:34 27648 --a------ C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 10:34 267776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 10:34 232960 --------- C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 10:34 230400 --a------ C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 10:34 193024 --------- C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 10:34 153088 --a------ C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 10:34 132608 --------- C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 10:34 124928 --------- C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 10:34 1152000 --------- C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 10:34 105984 --------- C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 10:34 102400 --------- C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 04:27 63488 --------- C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 04:27 625152 --------- C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 04:27 13824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 03:00 161792 --a------ C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 02:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-26 02:08 1104896 --------- C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 09:31 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-19 09:31 282112 --------- C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 06:23 1033216 --a------ C:\WINDOWS\explorer.exe
2007-06-13 06:23 1033216 --------- C:\WINDOWS\system32\dllcache\explorer.exe
2007-01-02 21:03 774144 --a------ C:\Program Files\RngInterstitial.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 03:11]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 19:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\DOCUME~1\MICHAE~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyaaay]
xxyaaay.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Reminder.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk
backup=C:\WINDOWS\pss\Event Reminder.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Michael Biggs^Start Menu^Programs^Startup^Event Reminder.lnk]
path=C:\Documents and Settings\Michael Biggs\Start Menu\Programs\Startup\Event Reminder.lnk
backup=C:\WINDOWS\pss\Event Reminder.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Michael Biggs^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\Michael Biggs\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Michael Biggs^Start Menu^Programs^Startup^Lotus SmartSuite 9.6 - English Registration.lnk]
path=C:\Documents and Settings\Michael Biggs\Start Menu\Programs\Startup\Lotus SmartSuite 9.6 - English Registration.lnk
backup=C:\WINDOWS\pss\Lotus SmartSuite 9.6 - English Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Lotus Organizer EasyClip.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Lotus Organizer EasyClip.lnk
backup=C:\WINDOWS\pss\Lotus Organizer EasyClip.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Lotus QuickStart.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Lotus QuickStart.lnk
backup=C:\WINDOWS\pss\Lotus QuickStart.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Lotus SmartCenter.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Lotus SmartCenter.lnk
backup=C:\WINDOWS\pss\Lotus SmartCenter.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Lotus SuiteStart.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Lotus SuiteStart.lnk
backup=C:\WINDOWS\pss\Lotus SuiteStart.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=C:\WINDOWS\pss\Quicken Scheduled Updates.lnkCommon Startup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell AIO Printer A940]
"C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagent]
"C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"C:\Program Files\Dell\Media Experience\PCMService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tgcmd]
"C:\Program Files\support.com\bin\tgcmd.exe" /server

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector]
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\UpdReg.EXE

R1 DcCam;Kodak Camera Proxy;C:\WINDOWS\system32\DRIVERS\DcCam.sys
R2 DCFS2K;Kodak DCFS2K Driver;C:\WINDOWS\system32\drivers\dcfs2k.sys
R2 EraserSvc10732;Symantec Eraser Service;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon
S1 Exportit;Exportit;C:\WINDOWS\system32\DRIVERS\exportit.sys
S2 Ca533av;V3345 Video Device;C:\WINDOWS\system32\Drivers\Ca533av.sys
S3 DcFpoint;DcFpoint;C:\WINDOWS\system32\DRIVERS\DcFpoint.sys
S3 DcLps;Legacy Polling Service;C:\WINDOWS\system32\DRIVERS\DcLps.sys
S3 DcPTP;dcptp;C:\WINDOWS\system32\DRIVERS\DcPTP.sys
S3 USBCamera;V3345 Digital Camera;C:\WINDOWS\system32\Drivers\Bulk533.sys

*Newly Created Service* - COMHOST

Contents of the 'Scheduled Tasks' folder
2007-08-28 01:11:42 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Michael Biggs.job - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-31 22:27:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-31 22:29:27 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-31 22:29

--- E O F ---


Category: Security risks
Date Time,Feature,Risk Name,Result,Item Type,Virus Definition Version,Product Version,User Name,Computer Name,Details
8/31/2007 10:23:19 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 10:17:06 PM,Auto-Protect,Downloader,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\valera[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 10:14:19 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\ZA3LXDOI\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188612857,Action taken: Blocked"
8/31/2007 9:36:30 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 9:33:20 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188610400,Action taken: Blocked"
8/31/2007 9:33:19 PM,Auto-Protect,Downloader,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\valera[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 4:37:44 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\ZA3LXDOI\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 4:34:44 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\Q8LVEA2A\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 4:31:22 PM,Auto-Protect,Downloader,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\valera[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 4:29:08 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188592148,Action taken: Blocked"
8/31/2007 6:45:54 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\C4Q6NB37\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 6:43:01 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\C4Q6NB37\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 6:36:51 AM,Auto-Protect,Downloader,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\valera[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/31/2007 6:35:07 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188556506,Action taken: Blocked"
8/30/2007 6:49:33 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\O48EK46K\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 6:46:33 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\86WTCMOZ\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 6:43:36 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188513815,Action taken: Blocked"
8/30/2007 6:40:58 PM,Auto-Protect,Downloader,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\C4Q6NB37\valera[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 5:51:59 PM,Auto-Protect,Downloader,Fully removed,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: C:\WINDOWS\SYSTEM32\pvjsoroj.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188510717,Action taken: Fully removed"
8/30/2007 5:51:57 PM,Auto-Protect,Downloader,Fully removed,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: C:\WINDOWS\SYSTEM32\kmmwyewh.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188510715,Action taken: Fully removed"
8/30/2007 5:51:53 PM,Auto-Protect,Downloader,Fully removed,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: C:\WINDOWS\SYSTEM32\kevqybyh.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188510703,Action taken: Fully removed"
8/30/2007 5:49:50 PM,Auto-Protect,Downloader,Fully removed,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: C:\WINDOWS\SYSTEM32\fjecnmcq.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188510579,Action taken: Fully removed"
8/30/2007 5:47:36 PM,Auto-Protect,Downloader,Fully removed,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: C:\WINDOWS\SYSTEM32\asufffmi.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188510447,Action taken: Fully removed"
8/30/2007 5:47:34 PM,Auto-Protect,Downloader,Fully removed,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: C:\WINDOWS\SYSTEM32\aqelokni.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188510445,Action taken: Fully removed"
8/30/2007 5:47:33 PM,Auto-Protect,Downloader,Fully removed,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: C:\WINDOWS\SYSTEM32\abqgvofo.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188510422,Action taken: Fully removed"
8/30/2007 5:14:51 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 5:11:54 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 5:08:32 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188508112,Action taken: Blocked"
8/30/2007 5:06:21 PM,Auto-Protect,Downloader,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\valera[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 4:41:57 PM,Auto-Protect,Downloader,Fully removed,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: C:\WINDOWS\SYSTEM32\bybnhutr.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188506483,Action taken: Fully removed"
8/30/2007 4:39:44 PM,Virus scanner,Trojan.Vundo,Fully removed,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: c:\windows\system32\bybnhutr.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188506277,Action taken: Fully removed"
8/30/2007 4:38:04 PM,Auto-Protect,Downloader,Removal not attempted,File,2007.08.30.009,10.2.0.30,SYSTEM,BIGGS,"Source: C:\WINDOWS\SYSTEM32\bybnhutr.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188506276,Action taken: Removal not attempted"
8/30/2007 4:34:59 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\ZA3LXDOI\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 4:31:59 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\Q8LVEA2A\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 4:25:48 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\O48EK46K\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188505548,Action taken: Blocked"
8/30/2007 4:23:28 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\idien[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188505405,Action taken: Blocked"
8/30/2007 7:07:51 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 7:04:53 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\86WTCMOZ\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/30/2007 6:58:54 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188471534,Action taken: Blocked"
8/30/2007 6:34:12 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188470052,Action taken: Blocked"
8/29/2007 9:20:57 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/29/2007 9:18:07 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/29/2007 9:12:40 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\O48EK46K\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188436360,Action taken: Blocked"
8/29/2007 7:48:55 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\C4Q6NB37\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/29/2007 7:42:54 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/29/2007 7:40:00 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\Q8LVEA2A\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188430793,Action taken: Blocked"
8/29/2007 7:34:43 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temp\kuxjjwio.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188430482,Action taken: Blocked"
8/29/2007 7:34:43 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\ZA3LXDOI\idien[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188430482,Action taken: Blocked"
8/29/2007 5:26:26 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/29/2007 5:20:25 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/29/2007 5:17:59 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188422275,Action taken: Blocked"
8/29/2007 4:45:46 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/29/2007 4:42:46 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\86WTCMOZ\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/29/2007 4:40:44 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188420044,Action taken: Blocked"
8/28/2007 8:45:32 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\Q8LVEA2A\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/28/2007 8:42:31 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\ZA3LXDOI\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/28/2007 8:36:34 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188347793,Action taken: Blocked"
8/28/2007 7:07:52 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/28/2007 7:01:37 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/28/2007 6:58:38 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188341917,Action taken: Blocked"
8/28/2007 6:53:14 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\idien[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188341593,Action taken: Blocked"
8/28/2007 6:49:29 PM,Virus scanner,Trojan.Vundo,Fully removed,File,2007.08.28.017,10.2.0.30,SYSTEM,BIGGS,"Source: ,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188337926,Action taken: Fully removed"
8/28/2007 6:49:25 PM,Virus scanner,Tracking Cookie,Fully removed,File,2007.08.28.017,10.2.0.30,SYSTEM,BIGGS,"Source: ,Risk category: Cookie,Overall Risk Impact: Low,Performance: 0,Privacy: 1188337808,Action taken: Fully removed"
8/28/2007 5:46:09 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/28/2007 5:39:50 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/28/2007 5:34:39 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188336879,Action taken: Blocked"
8/28/2007 5:31:48 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188336707,Action taken: Blocked"
8/28/2007 5:31:47 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/28/2007 5:31:47 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/28/2007 4:30:53 PM,Virus scanner,Trojan.Vundo,Fully removed,File,2007.08.28.017,10.2.0.30,SYSTEM,BIGGS,"Source: c:\windows\system32\dhimncpl.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188332901,Action taken: Fully removed"
8/28/2007 4:20:08 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/28/2007 4:16:21 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\J62AJ3N1\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188332181,Action taken: Blocked"
8/28/2007 4:16:18 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/27/2007 9:11:54 PM,Virus scanner,Tracking Cookie,Removal not attempted,File,2007.08.26.016,10.2.0.30,SYSTEM,BIGGS,"Source: ,Risk category: Cookie,Overall Risk Impact: Low,Performance: 0,Privacy: 1188259388,Action taken: Removal not attempted"
8/27/2007 4:21:15 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/27/2007 4:18:16 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/27/2007 4:15:49 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188245748,Action taken: Blocked"
8/27/2007 4:12:45 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temp\ywamwsxg.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188245565,Action taken: Blocked"
8/27/2007 4:12:45 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\idien[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188245565,Action taken: Blocked"
8/27/2007 6:47:50 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\86WTCMOZ\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/27/2007 6:45:07 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\O48EK46K\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/27/2007 6:39:54 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\O48EK46K\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188211194,Action taken: Blocked"
8/26/2007 8:16:03 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/26/2007 8:16:03 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/26/2007 8:13:02 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188173581,Action taken: Blocked"
8/26/2007 7:43:37 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\Q8LVEA2A\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/26/2007 7:40:38 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\ZA3LXDOI\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/26/2007 7:37:34 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\Q8LVEA2A\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188171453,Action taken: Blocked"
8/26/2007 6:07:12 PM,Virus scanner,Tracking Cookie,Fully removed,File,2007.08.25.006,10.2.0.30,SYSTEM,BIGGS,"Source: ,Risk category: Cookie,Overall Risk Impact: Low,Performance: 0,Privacy: 1188162970,Action taken: Fully removed"
8/26/2007 1:16:01 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/26/2007 1:13:12 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\Q8LVEA2A\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/26/2007 1:08:05 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1188148084,Action taken: Blocked"
8/25/2007 9:16:05 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\O48EK46K\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/25/2007 9:16:05 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/24/2007 4:39:32 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/24/2007 4:33:43 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187987621,Action taken: Blocked"
8/24/2007 4:33:41 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\86WTCMOZ\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/24/2007 7:42:46 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\86WTCMOZ\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/24/2007 7:39:47 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\OYQK8I9P\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/24/2007 7:33:48 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\Q8LVEA2A\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187955228,Action taken: Blocked"
8/23/2007 4:20:06 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\86WTCMOZ\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/23/2007 4:17:05 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\DPP18FI3\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/23/2007 4:14:00 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\Q8LVEA2A\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187900039,Action taken: Blocked"
8/23/2007 4:11:54 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\J62AJ3N1\idien[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187899912,Action taken: Blocked"
8/23/2007 4:11:54 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temp\egiwuwgv.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187899912,Action taken: Blocked"
8/22/2007 6:38:52 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\C4Q6NB37\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/22/2007 6:36:18 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\C4Q6NB37\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/22/2007 6:32:50 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\ZA3LXDOI\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187821970,Action taken: Blocked"
8/22/2007 6:39:18 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/22/2007 6:33:19 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\N3R4AR1Q\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/22/2007 6:28:30 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\N3R4AR1Q\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187778509,Action taken: Blocked"
8/21/2007 5:08:17 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\QBY2RZXZ\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/21/2007 5:08:17 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\QBY2RZXZ\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/21/2007 5:03:07 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187730187,Action taken: Blocked"
8/21/2007 3:58:44 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\N3R4AR1Q\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/21/2007 3:55:50 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\N3R4AR1Q\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/21/2007 3:47:41 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9AEL8DLU\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187725659,Action taken: Blocked"
8/21/2007 12:40:45 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9AEL8DLU\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/21/2007 12:37:11 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9AEL8DLU\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/21/2007 12:31:48 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9AEL8DLU\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187713908,Action taken: Blocked"
8/21/2007 11:05:57 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9AEL8DLU\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/21/2007 10:59:50 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\TC1S149Q\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187708387,Action taken: Blocked"
8/21/2007 10:59:47 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/20/2007 8:16:55 PM,Virus scanner,Tracking Cookie,Fully removed,File,2007.08.19.008,10.2.0.30,SYSTEM,BIGGS,"Source: ,Risk category: Cookie,Overall Risk Impact: Low,Performance: 0,Privacy: 1187654661,Action taken: Fully removed"
8/20/2007 4:20:15 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\N3R4AR1Q\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/20/2007 4:17:11 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/20/2007 4:15:57 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187640956,Action taken: Blocked"
8/20/2007 6:41:43 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/20/2007 6:38:45 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/20/2007 6:34:23 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187606063,Action taken: Blocked"
8/19/2007 7:06:15 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/19/2007 7:03:02 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\3QBIESTR\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/19/2007 7:00:00 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9AEL8DLU\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187564399,Action taken: Blocked"
8/19/2007 4:49:13 PM,Virus scanner,Tracking Cookie,Fully removed,File,2007.08.18.007,10.2.0.30,SYSTEM,BIGGS,"Source: ,Risk category: Cookie,Overall Risk Impact: Low,Performance: 0,Privacy: 1187542323,Action taken: Fully removed"
8/19/2007 11:09:39 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/19/2007 11:04:12 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\N3R4AR1Q\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/19/2007 10:57:33 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187535452,Action taken: Blocked"
8/19/2007 8:29:40 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/19/2007 8:26:37 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/19/2007 8:24:21 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\N3R4AR1Q\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187526260,Action taken: Blocked"
8/18/2007 3:08:49 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/18/2007 3:05:52 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/18/2007 3:00:13 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187463610,Action taken: Blocked"
8/18/2007 1:10:35 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\QBY2RZXZ\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/18/2007 1:07:01 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187456820,Action taken: Blocked"
8/18/2007 1:07:00 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/18/2007 12:55:57 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/18/2007 12:49:51 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/18/2007 12:44:02 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9IGBY2IG\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187455440,Action taken: Blocked"
8/18/2007 12:13:21 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\QBY2RZXZ\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/18/2007 12:10:26 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\3QBIESTR\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/18/2007 12:05:38 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\TC1S149Q\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187453137,Action taken: Blocked"
8/17/2007 4:25:59 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\N3R4AR1Q\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/17/2007 4:22:37 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/17/2007 4:21:50 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187382109,Action taken: Blocked"
8/17/2007 6:32:06 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/17/2007 6:29:10 AM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9AEL8DLU\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/17/2007 6:26:10 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\N3R4AR1Q\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187346370,Action taken: Blocked"
8/17/2007 6:23:54 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\idien[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187346233,Action taken: Blocked"
8/17/2007 6:23:53 AM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temp\lacrbmbr.exe,Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187346233,Action taken: Blocked"
8/16/2007 10:25:46 PM,Virus scanner,Tracking Cookie,Fully removed,File,2007.08.16.024,10.2.0.30,SYSTEM,BIGGS,"Source: ,Risk category: Cookie,Overall Risk Impact: Low,Performance: 0,Privacy: 1187315855,Action taken: Fully removed"
8/16/2007 5:53:44 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/16/2007 5:51:19 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/16/2007 5:47:41 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187300860,Action taken: Blocked"
8/15/2007 10:38:28 PM,Virus scanner,Tracking Cookie,Fully removed,File,2007.08.15.008,10.2.0.30,SYSTEM,BIGGS,"Source: ,Risk category: Cookie,Overall Risk Impact: Low,Performance: 0,Privacy: 1187228570,Action taken: Fully removed"
8/15/2007 9:24:44 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\9AEL8DLU\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/15/2007 9:18:45 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/15/2007 9:14:43 PM,Auto-Protect,Trojan.Vundo,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\EDCNZTT5\lkjh[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Privacy: 1187226883,Action taken: Blocked"
8/15/2007 8:31:02 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\RFXH4OLU\_affvm[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"
8/15/2007 8:27:53 PM,Auto-Protect,Trojan Horse,Blocked,File,N/A,10.2.0.30,SYSTEM,BIGGS,"Source: C:\Documents and Settings\Michael Biggs\Local Settings\Temporary Internet Files\Content.IE5\7WZZOX65\jaun_20070726[1],Risk category: Virus,Overall Risk Impact: High,Performance: 1,Action taken: Blocked"

#4 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:10:13 AM

Posted 03 September 2007 - 08:34 AM

Make sure all hidden files are showing:
* Click 'Start'.
* Open 'My Computer'.
* Select the 'Tools' menu and click 'Folder Options'.
* Select the 'View' tab.
* Under the 'Hidden files and folders' heading select 'Show hidden files and folders'.
* Uncheck the 'Hide file extensions for known types' option.
* Uncheck the 'Hide protected operating system files (recommended)' option.
* Click Yes to confirm.
* Click OK.

Download/unzip wscsvcfix.exe (by Ramesh Srinivasan) to your desktop:
http://windowsxp.mvps.org/utils/wscfix.zip
Double click on wscsvcfix.exe then follow the prompts.
Restart your pc when you've done.

Click on Start>Run and type Services.msc then hit Ok.
Scroll down and find the service called:
Security Center (wscsvc)
When you find it, double-click on it.
In the next window that opens, click the 'Start' button if the service is stopped.
Then change the 'Startup Type:' to 'Automatic' if its set to 'Disabled.
Now press Apply and then Ok and close any open windows.

Download\install 'SuperAntiSpyware Home Edition Free Version' from here:
http://www.superantispyware.com/downloadfi...ANTISPYWAREFREE

Launch SuperAntiSpyware and click on 'Check for updates'.
Once the updates have been installed,exit SuperAntiSpyware.

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting 'Fix checked'.
Make sure all browser and all Windows Explorer windows are closed before fixing:
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O20 - Winlogon Notify: xxyaaay - xxyaaay.dll (file missing)

Exit Hijackthis.

Find and delete:
C:\Documents and Settings\MICHAE~1\Application Data\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint

Start SuperAntiSpyware.
On the main screen click on 'Scan your computer'.
Check: 'Perform Complete Scan'.
Click 'Next' to start the scan.

Superantispyware will now scan your computer,when it's finished it will list all/any infections found.
Make sure everything found has a checkmark next to it,then press 'Next'.
Click on 'Finish' when you've done.

It's possible that the program will ask you to reboot in order to delete some files.

Obtain the SuperAntiSpyware log as follows:
Click on 'Preferences'.
Click on the 'Statistics/Logs' tab.
Under 'Scanner Logs' double click on 'SuperAntiSpyware Scan Log'.
It will then open in your default text editor,such as Notepad.
Copy and paste the contents of that report into your next reply.
Also post a new Hijackthis log,let me know how your pc is running now.

Posted Image
Posted Image

#5 meowandme

meowandme
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:13 AM

Posted 05 September 2007 - 07:34 PM

Richie,

The computer is running much better now...no popups! Here are the logs you requested:

Thank you!


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/03/2007 at 09:44 PM

Application Version : 3.9.1008

Core Rules Database Version : 3298
Trace Rules Database Version: 1306

Scan type : Complete Scan
Total Scan Time : 00:44:24

Memory items scanned : 408
Memory threats detected : 0
Registry items scanned : 6341
Registry threats detected : 0
File items scanned : 43406
File threats detected : 161

Adware.Tracking Cookie
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@cpvfeed[7].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@fastclick[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@bluestreak[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@247realmedia[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@partner2profit[5].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@oasc02.247realmedia[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@statse.webtrendslive[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@trafficmp[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.adbrite[5].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@anad.tacoda[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adopt.euroclick[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@server.iad.liveperson[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@anat.tacoda[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@specificclick[5].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tracking.foxnews[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@atwola[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@revsci[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@indiads[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@edge.ru4[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@media.adrevolver[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@mediaplex[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@inl-images.adbureau[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.pointroll[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@questionmarket[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@onlinerewardcenter[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.revsci[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@bs.serving-sys[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.cnn[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@server.iad.liveperson[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adopt.specificclick[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adbrite[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ehg-dig.hitbox[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@precisionclick[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@advertising[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@imrworldwide[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.monster[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@doubleclick[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.espn.adsonar[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@zedo[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@atdmt[5].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@2o7[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adrevolver[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@realmedia[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adserver.easyad[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@hitbox[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@inl.adbureau[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ad.yieldmanager[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tribalfusion[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adlegend[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ehg-myspaceinc.hitbox[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.addynamix[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@harpo.122.2o7[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@perf.overture[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tacoda[5].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@serving-sys[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@commission-junction[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@monstercom.112.2o7[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ecnext.advertserve[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@overture[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@247realmedia[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@247realmedia[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@247realmedia[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@247realmedia[5].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@2o7[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ad.interclick[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ad.yieldmanager[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ad.yieldmanager[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adbrite[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adbrite[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adbrite[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adinterax[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adlegend[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adopt.euroclick[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adopt.euroclick[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adopt.specificclick[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adopt.specificclick[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adrevolver[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adrevolver[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.adbrite[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.adbrite[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.adbrite[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.monster[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.pointroll[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@ads.revsci[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@adultfriendfinder[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@advertising[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@advertising[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@anad.tacoda[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@anat.tacoda[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@anat.tacoda[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@atdmt[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@atdmt[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@atdmt[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@bidzcom.112.2o7[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@bs.serving-sys[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@counter.auctionworks[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@cpvfeed[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@cpvfeed[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@cpvfeed[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@cpvfeed[5].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@cpvfeed[6].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@doubleclick[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@doubleclick[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@edge.ru4[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@fastclick[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@gcc-06.googleadservices[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@imrworldwide[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@indexstats[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@login.tracking101[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@media.adrevolver[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@media.adrevolver[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@mediaplex[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@nasdaq.122.2o7[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@oasc02.247realmedia[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@oasc02.247realmedia[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@overture[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@partner2profit[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@partner2profit[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@partner2profit[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@precisionclick[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@precisionclick[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@questionmarket[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@realmedia[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@realmedia[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@revenue[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@revsci[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@revsci[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@revsci[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@rss1.mediafed[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@sexbuddies[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@specificclick[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@specificclick[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@specificclick[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@statcounter[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@statse.webtrendslive[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tacoda[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tacoda[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tacoda[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tacoda[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tracking.foxnews[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tracking.foxnews[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tracking.foxnews[4].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@trafficmp[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tribalfusion[1].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tribalfusion[2].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tribalfusion[3].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@tribalfusion[5].txt
C:\Documents and Settings\Michael Biggs\Cookies\michael_biggs@zedo[1].txt

Adware.eZula
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP6\A0000157.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP7\A0000216.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000229.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000236.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000253.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000288.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000303.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000304.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000305.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000306.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000307.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000308.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP9\A0000309.EXE




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:50:47 PM, on 9/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\abc.bat.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\MICHAEL BIGGS\Application Data\Mozilla\Profiles\default\emqqto6c.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: DWABrowserHlprObj Class - {2709D830-B643-4e72-9A1E-701CFFFCF30C} - C:\WINDOWS\system32\dwabho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://webmail.gdatp.com/iNotes.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.3.1_02) - http://kronos.wcs.k12.va.us/WFC/plugins/j2..._3_1_02-win.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_...outLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_...aploader_v6.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://webmail.gdatp.com/dwa7W.cab
O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://playgames.comcast.net/online2/mahjo...ameLauncher.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Symantec Eraser Service (EraserSvc10732) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 9402 bytes




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users