Solved I am redirected to www.google.com/go?

July 12, 2011 at 02:55:50
Specs: Windows XP

When I perform a search in google most links redirect to www.google.com/go?(a number). In turn, that sends me to a site "www.poorssearch.net" and, finally to a crap ad-site. I tried the TDSSkiller and removed an atapi.sys infection, but I still have the problem!
I would appreciate any help!

See More: I am redirected to www.google.com/go?

Report •


✔ Best Answer
July 20, 2011 at 19:30:25

Thanks for the info, Johnw!

Now I can't get to it either.

vagmo,

Let’s try the EsetOnlineScanner, and see what kind of results we get from it.

First, temporarily disable your antivirus program , so that it does not interfere.

Note: This scan requires Internet Explorer,Opera or Firefox to work. Vista/Windows 7 users need to run Internet Explorer as Administrator.
To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run As Administrator from the context menu.

Then, download the esetsmartinstaller_enu.exe installer http://download.eset.com/special/eo...
Click the file to run the EsetOnlineScanner.

If you accept the Terms of Use, check the box and click: Start
It takes a couple minutes for the scanner to get ready.

When the Computer scan settings appear, check the following boxes:

Remove found threats
Scan unwanted applications

Next to 'Current scan targets: Operating memory, Local drives', click: Change Make sure you place a check next to all disk drives, including any external drives that are attached (no need to check off the floppy or DVD/CDROM drives).

Now, click the Advanced option, then, place a check next to the following (if it is not already checked):

Enable Anti-Stealth technology

Click Start.

This scan may take a while, so please be patient.

A log opens when the scan is complete (If not, go to C:\Program Files\EsetOnlineScanner\ and open the file log.txt).

Click Edit > Select All, and copy/paste the Eset log in your reply.

~~~~
Retired - Doin' Dis, Dat, and slapping malware.



#1
July 12, 2011 at 08:46:09

Hi AmThreath!
Thank you very much for your help. However, the procedure described there didn´t work. I followed also step by step the procedure described in http://forums.majorgeeks.com/showth... With all the scans performed I managed to remove around 27 items, but I still get redirected very often by google!


Report •

#2
July 12, 2011 at 10:00:25

vagmo,

Try the following:

Please download TDSSKiller
http://support.kaspersky.com/downlo...

Save it to the Desktop.

Now, double-click* on TDSSKiller.exe to run the program.

Click the 'Start Scan' button.

Do not use the computer during the scan

If the scan completes with nothing found, click Close to exit.

When the scan finishes it displays a Scan results screen stating whether or not an infection was found on your computer.

To remove the infection, click on the Continue button.
If it does not say Cure on the results screen, leave it at the default action of Skip, and press the Continue button.

Do not change to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.

Reboot to finish the cleaning process.

A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) is created and saved to the root directory (usually Local Disk C:).

>>Please provide the contents of TDSSKiller in your reply.<<


Now, download iExplore.exe, which is a renamed copy of RKill:
http://www.bleepingcomputer.com/dow...

[If the file does not download, paste the following, >without the brackets<, in the address bar of your browser:
[http://www.bleepingcomputer.com/download/anti-virus/rkill]

Save the file to the Desktop, and double-click on it.
Ignore any messages, and allow the file to run until the command window closes.


Without a reboot, download Malwarebytes’ Anti-Malware (black button with green and white icon) http://download.cnet.com/Malwarebyt...

Save to the Desktop:

Double-click mbam-setup.exe and follow the prompts to install the program.

Run Malwarfebytes’ AntiMalware and update the program.
Once updated, select Perform Full Scan and click the scan button.

When the scan finishes, click OK in the message box, and you will see the results of the scan.

Click the Remove Selected button to get rid of the malware.

When Malwarebytes finishes, you may be prompted to reboot. If so, reboot.


>>Please post the >Malwarebytes log< in your reply.<< so we can see where we are at, and plan any additional removal strategy.<<

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#3
July 13, 2011 at 01:38:17

aaflac44, thank you very much for your answer.

I had scanned already with TDSSkiller and Malwarebytes before. The first one found an infection of the atapi.sys file and repaired it and Malwarebytes found 26 infections in the registry and files. It cleaned all of them. I also ran SuperAntiSpyware, RootRepeal, Combofix and MGlogs as recommended in other forums. However, the problem persists.
I have now done again all the steps you mention and attach the new log files obtained. I have saved the


Report •

Related Solutions

#4
July 13, 2011 at 02:47:46

(sorry about the cut message above...)
I have saved the logfiles from the original scanning and I can attach them if necessary.

When repeating the scans according to the procedure you described, no infections are found, but I still get redirected on google search.
Here I include only the log files from these last scans I performed. Nothing seems to be detected now:

TDSSkillerlog:

2011/07/13 10:37:14.0734 2320 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56
2011/07/13 10:37:14.0921 2320 ================================================================================
2011/07/13 10:37:14.0921 2320 SystemInfo:
2011/07/13 10:37:14.0921 2320
2011/07/13 10:37:14.0921 2320 OS Version: 5.1.2600 ServicePack: 3.0
2011/07/13 10:37:14.0921 2320 Product type: Workstation
2011/07/13 10:37:14.0921 2320 ComputerName: FKIXXX
2011/07/13 10:37:14.0921 2320 UserName: Fki User
2011/07/13 10:37:14.0921 2320 Windows directory: C:\WINDOWS
2011/07/13 10:37:14.0921 2320 System windows directory: C:\WINDOWS
2011/07/13 10:37:14.0921 2320 Processor architecture: Intel x86
2011/07/13 10:37:14.0921 2320 Number of processors: 2
2011/07/13 10:37:14.0921 2320 Page size: 0x1000
2011/07/13 10:37:14.0921 2320 Boot type: Normal boot
2011/07/13 10:37:14.0921 2320 ================================================================================
2011/07/13 10:37:16.0953 2320 Initialize success
2011/07/13 10:37:18.0656 4088 ================================================================================
2011/07/13 10:37:18.0656 4088 Scan started
2011/07/13 10:37:18.0656 4088 Mode: Manual;
2011/07/13 10:37:18.0656 4088 ================================================================================
2011/07/13 10:37:20.0562 4088 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/07/13 10:37:20.0593 4088 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/07/13 10:37:20.0656 4088 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/07/13 10:37:20.0718 4088 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/07/13 10:37:20.0890 4088 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/07/13 10:37:20.0937 4088 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/07/13 10:37:20.0968 4088 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/07/13 10:37:21.0031 4088 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/07/13 10:37:21.0078 4088 b57w2k (3a3a82ffd268bcfb7ae6a48cecf00ad9) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
2011/07/13 10:37:21.0109 4088 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/07/13 10:37:21.0203 4088 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/07/13 10:37:21.0281 4088 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/07/13 10:37:21.0437 4088 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/07/13 10:37:21.0531 4088 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/07/13 10:37:21.0671 4088 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/07/13 10:37:21.0718 4088 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/07/13 10:37:21.0796 4088 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/07/13 10:37:21.0875 4088 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/07/13 10:37:21.0937 4088 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/07/13 10:37:21.0984 4088 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/07/13 10:37:22.0140 4088 eeCtrl (5461f01b7def17dc90d90b029f874c3b) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/07/13 10:37:22.0250 4088 EraserUtilRebootDrv (17fcc372d03ba39f3aee85198c0ec594) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
2011/07/13 10:37:22.0296 4088 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/07/13 10:37:22.0328 4088 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/07/13 10:37:22.0359 4088 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/07/13 10:37:22.0375 4088 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/07/13 10:37:22.0437 4088 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/07/13 10:37:22.0484 4088 fssfltr (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
2011/07/13 10:37:22.0531 4088 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/07/13 10:37:22.0546 4088 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/07/13 10:37:22.0578 4088 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/07/13 10:37:22.0625 4088 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/07/13 10:37:22.0687 4088 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/07/13 10:37:22.0734 4088 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys
2011/07/13 10:37:22.0812 4088 ialm (0f0194c4b635c10c3f785e4fee52d641) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/07/13 10:37:22.0953 4088 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/07/13 10:37:23.0046 4088 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/07/13 10:37:23.0093 4088 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/07/13 10:37:23.0140 4088 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/07/13 10:37:23.0171 4088 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/07/13 10:37:23.0203 4088 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/07/13 10:37:23.0234 4088 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/07/13 10:37:23.0265 4088 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/07/13 10:37:23.0296 4088 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/07/13 10:37:23.0546 4088 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/07/13 10:37:23.0578 4088 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/07/13 10:37:23.0609 4088 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/07/13 10:37:23.0640 4088 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/07/13 10:37:23.0765 4088 MBAMProtector (3d2c13377763eeac0ca6fb46f57217ed) C:\WINDOWS\system32\drivers\mbam.sys
2011/07/13 10:37:23.0812 4088 MBAMSwissArmy (b309912717c29fc67e1ba4730a82b6dd) C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011/07/13 10:37:23.0875 4088 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/07/13 10:37:23.0921 4088 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/07/13 10:37:23.0937 4088 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/07/13 10:37:23.0968 4088 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/07/13 10:37:24.0015 4088 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/07/13 10:37:24.0062 4088 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/07/13 10:37:24.0125 4088 MRxSmb (0dc719e9b15e902346e87e9dcd5751fa) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/07/13 10:37:24.0203 4088 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/07/13 10:37:24.0250 4088 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/07/13 10:37:24.0281 4088 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/07/13 10:37:24.0296 4088 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/07/13 10:37:24.0343 4088 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/07/13 10:37:24.0375 4088 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/07/13 10:37:24.0562 4088 NAVENG (920d9701bba90dbb7ccfd3536ea4d6f9) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110703.003\naveng.sys
2011/07/13 10:37:24.0625 4088 NAVEX15 (31b1a9b53c3319b97f7874347cd992d2) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110703.003\navex15.sys
2011/07/13 10:37:24.0734 4088 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/07/13 10:37:25.0046 4088 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/07/13 10:37:25.0078 4088 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/07/13 10:37:25.0109 4088 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/07/13 10:37:25.0312 4088 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/07/13 10:37:25.0375 4088 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/07/13 10:37:25.0390 4088 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/07/13 10:37:25.0484 4088 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/07/13 10:37:25.0546 4088 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/07/13 10:37:25.0625 4088 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/07/13 10:37:25.0656 4088 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/07/13 10:37:25.0687 4088 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/07/13 10:37:25.0750 4088 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/07/13 10:37:25.0781 4088 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/07/13 10:37:25.0828 4088 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/07/13 10:37:25.0859 4088 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/07/13 10:37:25.0921 4088 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/07/13 10:37:25.0953 4088 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/07/13 10:37:26.0125 4088 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/07/13 10:37:26.0156 4088 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/07/13 10:37:26.0187 4088 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/07/13 10:37:26.0234 4088 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/07/13 10:37:26.0328 4088 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/07/13 10:37:26.0359 4088 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/07/13 10:37:26.0390 4088 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/07/13 10:37:26.0453 4088 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/07/13 10:37:26.0500 4088 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/07/13 10:37:26.0531 4088 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/07/13 10:37:26.0578 4088 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/07/13 10:37:26.0640 4088 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/07/13 10:37:26.0656 4088 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/07/13 10:37:26.0781 4088 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/07/13 10:37:26.0812 4088 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2011/07/13 10:37:26.0890 4088 SAVRT (12b6e269ef8ac8ea36122544c8a1b6d8) C:\Program Files\Symantec AntiVirus\savrt.sys
2011/07/13 10:37:26.0921 4088 SAVRTPEL (97e5b6f3f95465e1f59360b59d8ec64e) C:\Program Files\Symantec AntiVirus\Savrtpel.sys
2011/07/13 10:37:27.0000 4088 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/07/13 10:37:27.0062 4088 senfilt (b9c7617c1e8ab6fdff75d3c8dafcb4c8) C:\WINDOWS\system32\drivers\senfilt.sys
2011/07/13 10:37:27.0140 4088 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/07/13 10:37:27.0187 4088 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/07/13 10:37:27.0218 4088 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/07/13 10:37:27.0312 4088 smwdm (c6d9959e493682f872a639b6ec1b4a08) C:\WINDOWS\system32\drivers\smwdm.sys
2011/07/13 10:37:27.0421 4088 SPBBCDrv (ef9760a364d836a0ce6149ebdf71524d) C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
2011/07/13 10:37:27.0515 4088 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/07/13 10:37:27.0546 4088 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/07/13 10:37:27.0625 4088 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/07/13 10:37:27.0687 4088 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
2011/07/13 10:37:27.0718 4088 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/07/13 10:37:27.0765 4088 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/07/13 10:37:27.0859 4088 SymEvent (49b20b430a4f219173f823536944474a) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
2011/07/13 10:37:27.0906 4088 SYMREDRV (626f733be7f951116c5c0804b068666c) C:\WINDOWS\System32\Drivers\SYMREDRV.SYS
2011/07/13 10:37:27.0921 4088 SYMTDI (cb7cc4ddbe09e224d4cd876760ba982c) C:\WINDOWS\System32\Drivers\SYMTDI.SYS
2011/07/13 10:37:28.0234 4088 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/07/13 10:37:28.0312 4088 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/07/13 10:37:28.0359 4088 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/07/13 10:37:28.0390 4088 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/07/13 10:37:28.0437 4088 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/07/13 10:37:28.0500 4088 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/07/13 10:37:28.0609 4088 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/07/13 10:37:28.0734 4088 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/07/13 10:37:28.0765 4088 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/07/13 10:37:28.0796 4088 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/07/13 10:37:29.0000 4088 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/07/13 10:37:29.0031 4088 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/07/13 10:37:29.0062 4088 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/07/13 10:37:29.0125 4088 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/07/13 10:37:29.0171 4088 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/07/13 10:37:29.0234 4088 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/07/13 10:37:29.0312 4088 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/07/13 10:37:29.0468 4088 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR5
2011/07/13 10:37:29.0484 4088 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk2\DR7
2011/07/13 10:37:29.0500 4088 Boot (0x1200) (3f46bf999b7e42fc506c766e973dbec6) \Device\Harddisk0\DR0\Partition0
2011/07/13 10:37:29.0515 4088 Boot (0x1200) (1037b3a63c5152860d13f934dbb1f997) \Device\Harddisk1\DR5\Partition0
2011/07/13 10:37:29.0515 4088 Boot (0x1200) (c60699d486ee8dd5d9cf0a2809cce33c) \Device\Harddisk2\DR7\Partition0
2011/07/13 10:37:29.0531 4088 ================================================================================
2011/07/13 10:37:29.0531 4088 Scan finished
2011/07/13 10:37:29.0531 4088 ================================================================================
2011/07/13 10:37:29.0546 2588 Detected object count: 0
2011/07/13 10:37:29.0546 2588 Actual detected object count: 0
2011/07/13 10:37:33.0625 2408 Deinitialize success

Malwarebytes log file:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 7110

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

2011-07-13 11:45:10
mbam-log-2011-07-13 (11-45-10).txt

Scan type: Full scan (C:\|)
Objects scanned: 227881
Time elapsed: 1 hour(s), 1 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Report •

#5
July 13, 2011 at 16:35:47

vagmo,

The following tool has had success in removing memory resident rootkits, etc.:

Please download the Kaspersky Virus Removal Tool:
http://devbuilds.kaspersky-labs.com...

Save it to your Desktop
Right-click the downloaded setup file and select 'Run as Administrator' to run it

At the main screen of the tool, in the AutoScan tab, make sure the first three options are checked
Next, scroll down to check the box next to the C:/ drive

Click on Start Scan

When the scan is finished, click on: Report (at the bottom)

In the Detailed Report screen, make sure the three buttons at the top are set to:
Autoscan, Do not group, and, Important events
Click on Save, and save to the Desktop

>>Please provide the Kaspersky Virus Removal Tool report in your reply.<<

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#6
July 14, 2011 at 06:14:45

aaflac44,
thanks again for your answer. I installed the Kaspersky Virus Removal Tool and ran a scan as you described. I realized that it was detecting items in the Symantec quarantine folder and therefore I stopped it, cleaned the quarantine, and restarted the Virus Removal Tool. It found lots of threats in the system volume information folder (I assume there were infected restore points?).

I think the Kaspersky Virus Removal Tool I downloaded has a different user interface, as I could not find the report options that you described. I could only save a complete report (with file by file description of the scanning) and a report on the detected threats. I attach the latter:

Status: Deleted (events: 383)
2011-07-14 10:38:36 Deleted Trojan program Trojan-Dropper.Win32.TDSS.uqa C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05D40002.VBN High
2011-07-14 10:38:36 Deleted Trojan program Trojan-Dropper.Win32.TDSS.uqa C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05D40002.VBN//CryptZ High
2011-07-14 10:38:38 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740000.VBN High
2011-07-14 10:38:38 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740000.VBN//CryptZ High
2011-07-14 10:38:39 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700000.VBN High
2011-07-14 10:38:39 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700000.VBN//CryptZ High
2011-07-14 10:38:53 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700001.VBN High
2011-07-14 10:38:53 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700001.VBN//CryptZ High
2011-07-14 10:39:18 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700002.VBN High
2011-07-14 10:39:18 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700002.VBN//CryptZ High
2011-07-14 10:39:18 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700003.VBN High
2011-07-14 10:39:18 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700003.VBN//CryptZ High
2011-07-14 10:39:19 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700004.VBN High
2011-07-14 10:39:19 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700004.VBN//CryptZ High
2011-07-14 10:39:36 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0000.VBN High
2011-07-14 10:39:36 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0000.VBN//CryptZ High
2011-07-14 10:39:36 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0000.VBN//CryptZ/Exploit$2.class High
2011-07-14 10:39:28 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0002.VBN High
2011-07-14 10:39:28 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0002.VBN//CryptZ High
2011-07-14 10:39:28 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0002.VBN//CryptZ/Exploit$2.class High
2011-07-14 10:39:35 Deleted Trojan program Trojan-Downloader.Java.Agent.jb C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0004.VBN High
2011-07-14 10:39:35 Deleted Trojan program Trojan-Downloader.Java.Agent.jb C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0004.VBN//CryptZ High
2011-07-14 10:39:35 Deleted Trojan program Trojan-Downloader.Java.Agent.jb C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0004.VBN//CryptZ/goog/main.class High
2011-07-14 10:39:28 Deleted Trojan program Exploit.Java.CVE-2010-0094.b C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0002.VBN//CryptZ/Exploit.class High
2011-07-14 10:39:28 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0002.VBN//CryptZ/PayloadCreater.class High
2011-07-14 10:39:28 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0002.VBN//CryptZ/PayloadClassLoader.class High
2011-07-14 10:39:35 Deleted Trojan program Trojan-Downloader.Java.Agent.jb C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0006.VBN High
2011-07-14 10:39:35 Deleted Trojan program Trojan-Downloader.Java.Agent.jb C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0006.VBN//CryptZ High
2011-07-14 10:39:35 Deleted Trojan program Trojan-Downloader.Java.Agent.jb C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0006.VBN//CryptZ/goog/main.class High
2011-07-14 10:39:36 Deleted Trojan program Exploit.Java.CVE-2010-0094.b C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0000.VBN//CryptZ/Exploit.class High
2011-07-14 10:39:36 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0000.VBN//CryptZ/PayloadCreater.class High
2011-07-14 10:39:36 Deleted Trojan program Exploit.Java.CVE-2010-0094.q C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\088C0000.VBN//CryptZ/PayloadClassLoader.class High
2011-07-14 10:41:38 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0000.VBN High
2011-07-14 10:41:38 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0000.VBN//CryptZ High
2011-07-14 10:41:40 Deleted Trojan program Trojan.Win32.TDSS.beeb C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A600001.VBN High
2011-07-14 10:41:40 Deleted Trojan program Trojan.Win32.TDSS.beeb C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A600001.VBN//CryptZ High
2011-07-14 10:41:39 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A600000.VBN High
2011-07-14 10:41:39 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A600000.VBN//CryptZ High
2011-07-14 10:42:04 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E380000.VBN High
2011-07-14 10:42:04 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E380000.VBN//CryptZ High
2011-07-14 10:42:04 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E440000.VBN High
2011-07-14 10:42:04 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E440000.VBN//CryptZ High
2011-07-14 10:42:03 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EA00000.VBN High
2011-07-14 10:42:03 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EA00000.VBN//CryptZ High
2011-07-14 10:42:14 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EA00001.VBN High
2011-07-14 10:42:14 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EA00001.VBN//CryptZ High
2011-07-14 10:42:12 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002C.VBN High
2011-07-14 10:42:14 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002B.VBN High
2011-07-14 10:42:12 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002C.VBN//CryptZ High
2011-07-14 10:42:14 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002B.VBN//CryptZ High
2011-07-14 10:42:23 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002D.VBN High
2011-07-14 10:42:23 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002D.VBN//CryptZ High
2011-07-14 10:42:23 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002E.VBN High
2011-07-14 10:42:23 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002E.VBN//CryptZ High
2011-07-14 10:42:22 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002F.VBN High
2011-07-14 10:42:22 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F10002F.VBN//CryptZ High
2011-07-14 10:42:32 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F100030.VBN High
2011-07-14 10:42:32 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0F100030.VBN//CryptZ High
2011-07-14 10:42:32 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740001\4FF6DE19.VBN High
2011-07-14 10:42:32 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740001\4FF6DE19.VBN//CryptZ High
2011-07-14 10:42:29 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740002\4FF6DE2E.VBN High
2011-07-14 10:42:29 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740002\4FF6DE2E.VBN//CryptZ High
2011-07-14 11:04:35 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740003\4FF6DE3A.VBN High
2011-07-14 11:04:35 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740003\4FF6DE3A.VBN//CryptZ High
2011-07-14 11:04:35 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740004\4FF6DFA0.VBN High
2011-07-14 11:04:35 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740004\4FF6DFA0.VBN//CryptZ High
2011-07-14 11:04:36 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740005\4FF6DFAE.VBN High
2011-07-14 11:04:36 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740005\4FF6DFAE.VBN//CryptZ High
2011-07-14 11:04:47 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740006\4FF6DFBA.VBN High
2011-07-14 11:04:47 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740006\4FF6DFBA.VBN//CryptZ High
2011-07-14 11:04:48 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740007\4FF6E121.VBN High
2011-07-14 11:04:48 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740007\4FF6E121.VBN//CryptZ High
2011-07-14 11:04:47 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740008\4FF6E2AC.VBN High
2011-07-14 11:04:47 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740008\4FF6E2AC.VBN//CryptZ High
2011-07-14 11:04:54 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740009\4FF6E428.VBN High
2011-07-14 11:04:54 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\03740009\4FF6E428.VBN//CryptZ High
2011-07-14 11:04:54 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000A\4FF6E5B1.VBN High
2011-07-14 11:04:54 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000A\4FF6E5B1.VBN//CryptZ High
2011-07-14 11:04:55 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000B\4FF6E731.VBN High
2011-07-14 11:04:55 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000B\4FF6E731.VBN//CryptZ High
2011-07-14 11:05:03 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000C\4FF6E8B1.VBN High
2011-07-14 11:05:03 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000C\4FF6E8B1.VBN//CryptZ High
2011-07-14 11:05:02 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000D\4FF6EA25.VBN High
2011-07-14 11:05:02 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000D\4FF6EA25.VBN//CryptZ High
2011-07-14 11:05:05 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000E\4FF6EB8D.VBN High
2011-07-14 11:05:05 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0374000E\4FF6EB8D.VBN//CryptZ High
2011-07-14 11:05:09 Deleted Trojan program Trojan-Downloader.Win32.Mufanom.amhh C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05D40003\4DFD47B5.VBN High
2011-07-14 11:05:09 Deleted Trojan program Trojan-Downloader.Win32.Mufanom.amhh C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05D40003\4DFD47B5.VBN//CryptZ High
2011-07-14 11:05:09 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700005\4FF6B2D7.VBN High
2011-07-14 11:05:09 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700005\4FF6B2D7.VBN//CryptZ High
2011-07-14 11:05:13 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700007\4FF6B601.VBN High
2011-07-14 11:05:13 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700007\4FF6B601.VBN//CryptZ High
2011-07-14 11:05:14 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700006\4FF6B5E2.VBN High
2011-07-14 11:05:14 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700006\4FF6B5E2.VBN//CryptZ High
2011-07-14 11:05:19 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700008\4FF6B60E.VBN High
2011-07-14 11:05:19 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700008\4FF6B60E.VBN//CryptZ High
2011-07-14 11:05:18 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700009\4FF6B61B.VBN High
2011-07-14 11:05:18 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700009\4FF6B61B.VBN//CryptZ High
2011-07-14 11:05:21 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000A\4FF6B628.VBN High
2011-07-14 11:05:21 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000A\4FF6B628.VBN//CryptZ High
2011-07-14 11:05:22 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000B\4FF6B7BE.VBN High
2011-07-14 11:05:22 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000B\4FF6B7BE.VBN//CryptZ High
2011-07-14 11:05:31 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000C\4FF6B950.VBN High
2011-07-14 11:05:31 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000C\4FF6B950.VBN//CryptZ High
2011-07-14 11:05:31 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000D\4FF6BB2B.VBN High
2011-07-14 11:05:31 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000D\4FF6BB2B.VBN//CryptZ High
2011-07-14 11:05:30 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000E\4FF6BCE0.VBN High
2011-07-14 11:05:30 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000E\4FF6BCE0.VBN//CryptZ High
2011-07-14 11:05:58 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000F\4FF6BE4B.VBN High
2011-07-14 11:05:58 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0770000F\4FF6BE4B.VBN//CryptZ High
2011-07-14 11:05:58 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700010\4FF6BFB3.VBN High
2011-07-14 11:05:58 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700010\4FF6BFB3.VBN//CryptZ High
2011-07-14 11:05:59 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700011\4FF6C11C.VBN High
2011-07-14 11:05:59 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700011\4FF6C11C.VBN//CryptZ High
2011-07-14 11:06:10 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700012\4FF6C283.VBN High
2011-07-14 11:06:10 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700012\4FF6C283.VBN//CryptZ High
2011-07-14 11:06:10 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700013\4FF6C3EB.VBN High
2011-07-14 11:06:10 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700013\4FF6C3EB.VBN//CryptZ High
2011-07-14 11:06:07 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700014\4FF6C553.VBN High
2011-07-14 11:06:07 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700014\4FF6C553.VBN//CryptZ High
2011-07-14 11:08:38 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700015\4FF6C6BA.VBN High
2011-07-14 11:08:38 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07700015\4FF6C6BA.VBN//CryptZ High
2011-07-14 11:08:39 Deleted Trojan program Trojan-Downloader.Win32.Mufanom.bgbc C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09CC0000\4DDFA249.VBN High
2011-07-14 11:08:39 Deleted Trojan program Trojan-Downloader.Win32.Mufanom.bgbc C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09CC0000\4DDFA249.VBN//CryptZ High
2011-07-14 11:08:38 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0001\4DFD597E.VBN High
2011-07-14 11:08:38 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0001\4DFD597E.VBN//CryptZ High
2011-07-14 12:14:07 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0002\4DFD59A9.VBN High
2011-07-14 12:14:07 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0002\4DFD59A9.VBN//CryptZ High
2011-07-14 12:14:07 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0003\4DFD5BDA.VBN High
2011-07-14 12:14:07 Deleted Trojan program Trojan.Win32.FraudPack.bkhe C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0003\4DFD5BDA.VBN//CryptZ High
2011-07-14 12:14:08 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0004\4DFD5BF3.VBN High
2011-07-14 12:14:08 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0004\4DFD5BF3.VBN//CryptZ High
2011-07-14 12:14:22 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0005\4DFD5C00.VBN High
2011-07-14 12:14:22 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0005\4DFD5C00.VBN//CryptZ High
2011-07-14 12:14:26 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0007\4DFD5C1A.VBN High
2011-07-14 12:14:25 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0006\4DFD5C0C.VBN High
2011-07-14 12:14:26 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0007\4DFD5C1A.VBN//CryptZ High
2011-07-14 12:14:25 Deleted Trojan program Trojan.Win32.TDSS.beea C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0006\4DFD5C0C.VBN//CryptZ High
2011-07-14 13:49:32 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP694\A0145915.dll High
2011-07-14 13:49:32 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP694\A0145915.dll//# High
2011-07-14 13:49:32 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP694\A0145929.dll High
2011-07-14 13:49:32 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP694\A0145929.dll//# High
2011-07-14 13:49:42 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP694\A0147929.dll High
2011-07-14 13:49:42 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP694\A0147929.dll//# High
2011-07-14 13:49:42 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0147972.dll High
2011-07-14 13:49:42 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0147972.dll//# High
2011-07-14 13:49:41 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0147978.dll High
2011-07-14 13:49:41 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0147978.dll//# High
2011-07-14 13:49:49 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0148978.dll High
2011-07-14 13:49:49 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0148978.dll//# High
2011-07-14 13:49:58 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0149978.dll High
2011-07-14 13:49:58 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0149978.dll//# High
2011-07-14 13:49:58 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0150978.dll High
2011-07-14 13:49:58 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0150978.dll//# High
2011-07-14 13:49:56 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0150989.dll High
2011-07-14 13:49:56 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0150989.dll//# High
2011-07-14 13:50:39 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0151054.dll High
2011-07-14 13:50:39 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0151054.dll//# High
2011-07-14 13:50:39 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0152054.dll High
2011-07-14 13:50:39 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP695\A0152054.dll//# High
2011-07-14 13:50:39 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0152070.dll High
2011-07-14 13:50:39 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0152070.dll//# High
2011-07-14 13:50:55 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0152084.dll High
2011-07-14 13:50:55 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0152084.dll//# High
2011-07-14 13:50:55 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0152090.dll High
2011-07-14 13:50:55 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0152090.dll//# High
2011-07-14 13:50:55 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0152106.dll High
2011-07-14 13:50:55 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0152106.dll//# High
2011-07-14 13:51:07 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0153106.dll High
2011-07-14 13:51:07 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP696\A0153106.dll//# High
2011-07-14 13:51:17 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP697\A0154106.dll High
2011-07-14 13:51:17 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP697\A0154106.dll//# High
2011-07-14 13:51:24 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP697\A0155171.dll High
2011-07-14 13:51:24 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP697\A0155171.dll//# High
2011-07-14 13:51:27 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP697\A0155199.dll High
2011-07-14 13:51:27 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP697\A0155199.dll//# High
2011-07-14 13:51:30 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP699\A0156199.dll High
2011-07-14 13:51:30 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP699\A0156199.dll//# High
2011-07-14 13:51:30 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP699\A0156206.dll High
2011-07-14 13:51:30 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP699\A0156206.dll//# High
2011-07-14 13:51:34 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP699\A0156224.dll High
2011-07-14 13:51:34 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP699\A0156224.dll//# High
2011-07-14 13:52:16 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP699\A0156325.dll High
2011-07-14 13:52:16 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP699\A0156325.dll//# High
2011-07-14 13:52:16 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP700\A0156348.dll High
2011-07-14 13:52:16 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP700\A0156348.dll//# High
2011-07-14 13:52:16 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP700\A0157348.dll High
2011-07-14 13:52:16 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP700\A0157348.dll//# High
2011-07-14 13:52:36 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP701\A0158348.dll High
2011-07-14 13:52:36 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP701\A0158348.dll//# High
2011-07-14 13:52:36 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP701\A0158399.dll High
2011-07-14 13:52:36 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP701\A0158399.dll//# High
2011-07-14 13:52:34 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP701\A0158494.dll High
2011-07-14 13:52:34 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP701\A0158494.dll//# High
2011-07-14 13:52:43 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP701\A0160494.dll High
2011-07-14 13:52:43 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP701\A0160494.dll//# High
2011-07-14 13:52:49 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP702\A0160510.dll High
2011-07-14 13:52:49 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP702\A0160510.dll//# High
2011-07-14 13:52:49 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP702\A0160519.dll High
2011-07-14 13:52:49 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP702\A0160519.dll//# High
2011-07-14 13:52:48 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0160539.dll High
2011-07-14 13:52:48 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0160539.dll//# High
2011-07-14 13:53:40 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0161541.dll High
2011-07-14 13:53:40 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0161541.dll//# High
2011-07-14 13:53:41 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0161556.dll High
2011-07-14 13:53:41 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0161556.dll//# High
2011-07-14 13:53:41 Deleted virus HEUR:Worm.Win32.Generic


Report •

#7
July 14, 2011 at 06:15:10

---continues from above

C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0161583.dll High
2011-07-14 13:53:41 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0161583.dll//# High
2011-07-14 13:53:42 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0161608.dll High
2011-07-14 13:53:42 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0161608.dll//# High
2011-07-14 13:53:42 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0162608.dll High
2011-07-14 13:53:42 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP703\A0162608.dll//# High
2011-07-14 13:53:48 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0162634.dll High
2011-07-14 13:53:48 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0162634.dll//# High
2011-07-14 13:54:00 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163634.dll High
2011-07-14 13:54:00 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163634.dll//# High
2011-07-14 13:54:00 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163649.dll High
2011-07-14 13:54:00 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163649.dll//# High
2011-07-14 13:54:01 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163655.dll High
2011-07-14 13:54:01 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163655.dll//# High
2011-07-14 13:54:02 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163671.dll High
2011-07-14 13:54:02 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163671.dll//# High
2011-07-14 13:54:10 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163940.dll High
2011-07-14 13:54:10 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0163940.dll//# High
2011-07-14 13:54:11 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0164940.dll High
2011-07-14 13:54:11 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP705\A0164940.dll//# High
2011-07-14 13:54:19 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0165940.dll High
2011-07-14 13:54:19 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0165940.dll//# High
2011-07-14 13:54:19 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0165949.dll High
2011-07-14 13:54:19 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0165949.dll//# High
2011-07-14 13:54:19 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0166949.dll High
2011-07-14 13:54:19 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0166949.dll//# High
2011-07-14 13:54:20 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0166963.dll High
2011-07-14 13:54:20 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0166963.dll//# High
2011-07-14 13:54:20 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0167963.dll High
2011-07-14 13:54:20 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0167963.dll//# High
2011-07-14 13:54:21 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0167981.dll High
2011-07-14 13:54:21 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP706\A0167981.dll//# High
2011-07-14 13:54:24 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP707\A0169981.dll High
2011-07-14 13:54:24 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP707\A0169981.dll//# High
2011-07-14 13:54:24 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP707\A0169987.dll High
2011-07-14 13:54:24 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP707\A0169987.dll//# High
2011-07-14 13:54:25 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP707\A0169994.dll High
2011-07-14 13:54:25 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP707\A0169994.dll//# High
2011-07-14 13:54:28 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP707\A0170994.dll High
2011-07-14 13:54:28 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP707\A0170994.dll//# High
2011-07-14 13:54:30 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0171000.dll High
2011-07-14 13:54:30 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0171000.dll//# High
2011-07-14 13:54:30 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0172000.dll High
2011-07-14 13:54:30 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0172000.dll//# High
2011-07-14 13:54:31 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0173009.dll High
2011-07-14 13:54:31 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0173009.dll//# High
2011-07-14 13:54:31 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0175010.dll High
2011-07-14 13:54:31 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0175010.dll//# High
2011-07-14 13:54:32 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0175017.dll High
2011-07-14 13:54:32 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0175017.dll//# High
2011-07-14 13:54:32 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0175023.dll High
2011-07-14 13:54:32 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0175023.dll//# High
2011-07-14 13:54:34 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0175046.dll High
2011-07-14 13:54:34 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0175046.dll//# High
2011-07-14 13:54:35 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0176046.dll High
2011-07-14 13:54:35 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0176046.dll//# High
2011-07-14 13:54:34 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0177046.dll High
2011-07-14 13:54:34 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0177046.dll//# High
2011-07-14 13:54:36 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0178046.dll High
2011-07-14 13:54:36 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0178046.dll//# High
2011-07-14 13:54:38 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0179046.dll High
2011-07-14 13:54:38 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0179046.dll//# High
2011-07-14 13:54:39 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0180046.dll High
2011-07-14 13:54:39 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP708\A0180046.dll//# High
2011-07-14 13:55:25 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP709\A0181091.dll High
2011-07-14 13:55:25 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP709\A0181091.dll//# High
2011-07-14 13:55:26 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP709\A0181085.dll High
2011-07-14 13:55:26 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP709\A0181085.dll//# High
2011-07-14 13:55:25 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP709\A0181111.dll High
2011-07-14 13:55:25 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP709\A0181111.dll//# High
2011-07-14 13:55:30 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP710\A0181225.dll High
2011-07-14 13:55:30 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP710\A0181225.dll//# High
2011-07-14 13:55:33 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP711\A0181247.dll High
2011-07-14 13:55:33 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP711\A0181247.dll//# High
2011-07-14 13:55:34 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP711\A0181254.dll High
2011-07-14 13:55:34 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP711\A0181254.dll//# High
2011-07-14 13:55:35 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP711\A0182254.dll High
2011-07-14 13:55:35 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP711\A0182254.dll//# High
2011-07-14 13:55:38 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP712\A0182265.dll High
2011-07-14 13:55:38 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP712\A0182265.dll//# High
2011-07-14 13:55:39 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP712\A0183265.dll High
2011-07-14 13:55:39 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP712\A0183265.dll//# High
2011-07-14 13:55:40 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP713\A0184291.dll High
2011-07-14 13:55:40 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP713\A0184291.dll//# High
2011-07-14 13:55:41 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP713\A0185291.dll High
2011-07-14 13:55:41 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP713\A0185291.dll//# High
2011-07-14 13:55:41 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP713\A0185310.dll High
2011-07-14 13:55:41 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP713\A0185310.dll//# High
2011-07-14 13:55:44 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP714\A0185379.dll High
2011-07-14 13:55:44 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP714\A0185379.dll//# High
2011-07-14 13:55:45 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP714\A0186379.dll High
2011-07-14 13:55:45 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP714\A0186379.dll//# High
2011-07-14 13:55:45 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP714\A0186385.dll High
2011-07-14 13:55:45 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP714\A0186385.dll//# High
2011-07-14 13:55:45 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP714\A0186403.dll High
2011-07-14 13:55:45 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP714\A0186403.dll//# High
2011-07-14 13:55:47 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP715\A0186440.dll High
2011-07-14 13:55:47 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP715\A0186440.dll//# High
2011-07-14 13:55:52 Deleted Trojan program Trojan-Proxy.Win32.Agent.egy C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0186481.dll High
2011-07-14 13:55:52 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0186485.dll High
2011-07-14 13:55:52 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0186485.dll//# High
2011-07-14 13:55:54 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0186502.dll High
2011-07-14 13:55:54 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0186502.dll//# High
2011-07-14 13:55:55 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0186537.dll High
2011-07-14 13:55:55 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0186537.dll//# High
2011-07-14 13:55:56 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188537.dll High
2011-07-14 13:55:56 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188537.dll//# High
2011-07-14 13:55:56 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188543.dll High
2011-07-14 13:55:56 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188543.dll//# High
2011-07-14 13:55:57 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188572.dll High
2011-07-14 13:55:57 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188572.dll//# High
2011-07-14 13:56:04 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188655.dll High
2011-07-14 13:56:04 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188655.dll//# High
2011-07-14 13:56:06 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188684.dll High
2011-07-14 13:56:06 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP716\A0188684.dll//# High
2011-07-14 13:56:16 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP717\A0188779.dll High
2011-07-14 13:56:16 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP717\A0188779.dll//# High
2011-07-14 13:56:18 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP717\A0188830.dll High
2011-07-14 13:56:18 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP717\A0188830.dll//# High
2011-07-14 13:56:19 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP717\A0188839.dll High
2011-07-14 13:56:19 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP717\A0188839.dll//# High
2011-07-14 13:56:22 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0188894.dll High
2011-07-14 13:56:22 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0188894.dll//# High
2011-07-14 13:57:30 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0189029.dll High
2011-07-14 13:57:30 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0189029.dll//# High
2011-07-14 13:57:30 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0189066.dll High
2011-07-14 13:57:30 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0189066.dll//# High
2011-07-14 13:57:31 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0189076.dll High
2011-07-14 13:57:31 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0189076.dll//# High
2011-07-14 13:57:31 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0189083.dll High
2011-07-14 13:57:31 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0189083.dll//# High
2011-07-14 13:57:34 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0190083.dll High
2011-07-14 13:57:34 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0190083.dll//# High
2011-07-14 13:57:35 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0190099.dll High
2011-07-14 13:57:35 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP718\A0190099.dll//# High
2011-07-14 13:57:38 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP719\A0191119.dll High
2011-07-14 13:57:38 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP719\A0191119.dll//# High
2011-07-14 13:57:38 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP719\A0192131.dll High
2011-07-14 13:57:38 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP719\A0192131.dll//# High
2011-07-14 13:57:40 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0192150.dll High
2011-07-14 13:57:40 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0192150.dll//# High
2011-07-14 13:57:40 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193150.dll High
2011-07-14 13:57:40 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193150.dll//# High
2011-07-14 13:57:42 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193229.dll High
2011-07-14 13:57:42 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193229.dll//# High
2011-07-14 13:57:43 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193239.dll High
2011-07-14 13:57:43 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193239.dll//# High
2011-07-14 13:57:43 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193249.dll High
2011-07-14 13:57:43 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193249.dll//# High
2011-07-14 13:57:44 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193254.dll High
2011-07-14 13:57:43 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193254.dll//# High
2011-07-14 13:57:48 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193489.dll High
2011-07-14 13:57:48 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193489.dll//# High
2011-07-14 13:57:50 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193504.dll High
2011-07-14 13:57:50 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193504.dll//# High
2011-07-14 13:57:52 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193509.dll High
2011-07-14 13:57:52 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193509.dll//# High
2011-07-14 13:57:52 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193515.dll High
2011-07-14 13:57:52 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193515.dll//# High
2011-07-14 13:57:52 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193521.dll High
2011-07-14 13:57:52 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0193521.dll//# High
2011-07-14 13:57:53 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0194527.dll High
2011-07-14 13:57:53 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0194527.dll//# High
2011-07-14 13:57:53 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0194534.dll High
2011-07-14 13:57:53 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP720\A0194534.dll//# High
2011-07-14 13:57:56 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP721\A0194537.dll High
2011-07-14 13:57:56 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP721\A0194537.dll//# High
2011-07-14 13:58:00 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP722\A0195551.dll High
2011-07-14 13:58:00 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP722\A0195551.dll//# High
2011-07-14 13:58:01 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP722\A0195559.dll High
2011-07-14 13:58:01 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP722\A0195559.dll//# High
2011-07-14 13:58:14 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP723\A0195688.dll High
2011-07-14 13:58:14 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP723\A0195688.dll//# High
2011-07-14 13:59:33 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP723\A0195941.dll High
2011-07-14 13:59:33 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP723\A0195941.dll//# High
2011-07-14 13:59:33 Deleted virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP723\A0195950.dll High
2011-07-14 13:59:33 Deleted Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP723\A0195950.dll//# High
Status: Absent (events: 2)
2011-07-14 14:31:15 Not found virus HEUR:Worm.Win32.Generic C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP693\A0144915.dll High
2011-07-14 14:31:15 Not found Trojan program Trojan.Win32.Cosmu.amri C:\System Volume Information\_restore{67226B84-6588-4EC8-BA0B-D59DDB4EC5DD}\RP693\A0144915.dll//# High


Report •

#8
July 14, 2011 at 16:22:57

vagmo,

Let’s do the following:

Please reset System Restore:

Click Start > All Programs > Accessories > System Tools, and click on System Restore tab

Check the box that says "Turn off System Restore on all drives"
Click: Apply.

Click Yes, and agree to the prompt.
This will delete Restore Points.

Click OK in the Properties window, and restart the computer.


When the Desktop appears once again, go back to System Restore and this time uncheck: "Turn off System Restore..."
Click Apply, and then, OK.


Now, set up a Restore Point:
Close any programs that are open.
Click Start > All Programs > Accessories > System Tools, and click on System Restore.

Click: ‘Create a Restore Point‘, and click Next.
In the Restore Point description box, type a description for the restore point.
(i.e.: clean slate)

Click the ‘Create’ button.


Now, temporarily disable all AntiVirus/AntiSpyware software while these steps are being completed to keep these programs from interfering with the repairs.

This can normally be done by right clicking the software's Taskbar icon, or accessing each software through Start - Programs.

Some tips if needed:
http://www.bleepingcomputer.com/for...

Run the Kasperski Virus Removal Tool again, and post its report.

When done, check to see if you are still getting redirected, and post the outcome.

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#9
July 14, 2011 at 18:47:53

Also, let's see if the Alureon/TDSS RootKit affecting atapi.sys is detected, and hiding somewhere in your system...

Please download GMER:
http://gmer.net/download.php
[Downloads a randomly named file. (Recommended)]

Disconnect from the Internet and close all running programs.

Temporarily disable any real-time active protection so your security programs do not conflict with gmer's driver.
Info:
http://www.bleepingcomputer.com/for...

Double-click on the randomly named GMER file (i.e. n7gmo46c.exe)
Allow the gmer.sys driver to load...

GMER opens to the Rootkit/Malware tab and performs an automatic quick scan when first run. (Please do not use the computer while the scan is in progress.)

If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO

Now, click the >Scan< button.
If you see a rootkit warning window, click OK.

When the scan finishes, click the 'Save...' button to save the scan results to your Desktop.
Save the file as >gmer.log<

>>Click the Copy button and Paste the results of the GMER log in your reply.<<

Note: Please, do not take action on any of the information on the GMER report!!

If you encounter any problems, try running GMER in Safe Mode:
http://www.computerhope.com/issues/...

If GMER crashes or keeps resulting in a BSODs, uncheck 'Devices' (on the right side) before scanning.

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#10
July 15, 2011 at 05:04:43

aaflac44,
I have reseted System Restore and ran the Kasperski Virus Removal Tool again. This time, no threats were found. I still get only a full report showing all scanned objects (over 300 thousand lines). Most of them show "OK" in the results tab. Only the pagefile.sys is shown as "not processed" "object is locked".

I tried Google in Firefox and I still got redirected. I then disconnected the internet, turned off the real time protection and ran Gmer. I attach the log file. No problems were detected, but i still keep getting redirected.

The Gmer log :

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-07-15 13:57:16
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e WDC_WD800JD-75MSA1 rev.10.01E01
Running: iyr44c9w.exe; Driver: C:\DOCUME~1\FKIUSE~1\LOCALS~1\Temp\uxtdypog.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwAdjustPrivilegesToken [0xA8B70690]
SSDT 868BEAD0 ZwAlertResumeThread
SSDT 868C2E50 ZwAlertThread
SSDT 8699FBE8 ZwAllocateVirtualMemory
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwClose [0xA8B70F94]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwConnectPort [0xA8B71DC8]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreateEvent [0xA8B72312]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreateFile [0xA8B71270]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreateKey [0xA8B6F500]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreateMutant [0xA8B721F8]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreateNamedPipeFile [0xA8B7027E]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreatePort [0xA8B720CC]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreateSection [0xA8B70426]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreateSemaphore [0xA8B72432]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreateThread [0xA8B70C1C]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwCreateWaitablePort [0xA8B72162]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwDebugActiveProcess [0xA8B73B1A]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwDeleteKey [0xA8B6FB0A]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwDeleteValueKey [0xA8B6FEBE]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwDeviceIoControlFile [0xA8B716F2]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwDuplicateObject [0xA8B74D26]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwEnumerateKey [0xA8B7000A]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwEnumerateValueKey [0xA8B700A2]
SSDT 868A14A0 ZwFreeVirtualMemory
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwFsControlFile [0xA8B71500]
SSDT 868C26B0 ZwImpersonateAnonymousToken
SSDT 868C2898 ZwImpersonateThread
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwLoadDriver [0xA8B73C0C]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwLoadKey [0xA8B6F4DC]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwLoadKey2 [0xA8B6F4EE]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwMapViewOfSection [0xA8B74374]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwNotifyChangeKey [0xA8B701CE]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwOpenEvent [0xA8B723A8]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwOpenFile [0xA8B71016]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwOpenKey [0xA8B6F6C0]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwOpenMutant [0xA8B72288]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwOpenProcess [0xA8B708CC]
SSDT 868B5148 ZwOpenProcessToken
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwOpenSection [0xA8B7410E]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwOpenSemaphore [0xA8B724C8]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwOpenThread [0xA8B707BE]
SSDT 868BCA30 ZwOpenThreadToken
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwQueryKey [0xA8B7013A]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwQueryMultipleValueKey [0xA8B6FD72]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwQuerySection [0xA8B746AE]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwQueryValueKey [0xA8B6F99C]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwQueueApcThread [0xA8B73FA0]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwRenameKey [0xA8B6FC2C]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwReplaceKey [0xA8B6EF16]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwReplyPort [0xA8B7282C]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwReplyWaitReceivePort [0xA8B726F2]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwRequestWaitReplyPort [0xA8B738B4]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwRestoreKey [0xA8B6F28E]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwResumeThread [0xA8B74BC8]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSaveKey [0xA8B6EEAE]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSecureConnectPort [0xA8B71B0E]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSetContextThread [0xA8B70E38]
SSDT 868BD5B8 ZwSetInformationProcess
SSDT 868BE8E8 ZwSetInformationThread
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSetInformationToken [0xA8B73154]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSetSecurityObject [0xA8B73DAA]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSetSystemInformation [0xA8B747FE]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSetValueKey [0xA8B6F816]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSuspendProcess [0xA8B748F0]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSuspendThread [0xA8B74A2A]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwSystemDebugControl [0xA8B73A3E]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwTerminateProcess [0xA8B70A68]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwTerminateThread [0xA8B709C8]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwUnmapViewOfSection [0xA8B74552]
SSDT \SystemRoot\system32\DRIVERS\0095957drv.sys ZwWriteVirtualMemory [0xA8B70B52]

Code \SystemRoot\system32\DRIVERS\0095957drv.sys FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\0095957drv.sys IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!FsRtlCheckLockForReadAccess 804EAF84 5 Bytes JMP A8B62FD0 \SystemRoot\system32\DRIVERS\0095957drv.sys
.text ntkrnlpa.exe!IoIsOperationSynchronous 804EF912 5 Bytes JMP A8B633AC \SystemRoot\system32\DRIVERS\0095957drv.sys
.text ntkrnlpa.exe!ZwCallbackReturn + 2C10 805044AC 12 Bytes [90, 06, B7, A8, D0, EA, 8B, ...] {NOP ; PUSH ES; MOV BH, 0xa8; SHR DL, 0x1; MOV EAX, [ESI-0x7973d1b0]}
.text ntkrnlpa.exe!ZwCallbackReturn + 2C28 805044C4 4 Bytes [E8, FB, 99, 86]
.text ntkrnlpa.exe!ZwCallbackReturn + 2CC4 80504560 5 Bytes [62, 21, B7, A8, 1A]
.text ntkrnlpa.exe!ZwCallbackReturn + 2CCA 80504566 2 Bytes [B7, A8] {MOV BH, 0xa8}
.text ntkrnlpa.exe!ZwCallbackReturn + 2D68 80504604 12 Bytes [0C, 3C, B7, A8, DC, F4, B6, ...] {OR AL, 0x3c; MOV BH, 0xa8; FDIVR ST(4), ST; MOV DH, 0xa8; OUT DX, AL ; HLT ; MOV DH, 0xa8}
.text ...
init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xF7048F80]
? system32\DRIVERS\0095957drv.sys The system cannot find the path specified. !
? system32\DRIVERS\15167981.sys The system cannot find the path specified. !

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

---- EOF - GMER 1.0.15 ----

Thank you very much for your help with this problem!



Report •

#11
July 15, 2011 at 19:34:57

vagmo,

Are the redirections happening in both IE, and FireFox, or just in FireFox?

Also, do you use a router?


Please download GooredFix:
http://jpshortstuff.247fixes.com/Go...

Save to the Desktop.

Make sure all FireFox windows are closed.

To run the tool, double-click it (XP), or, (Vista/Win 7) right-click and select: Run As Administrator

When prompted to run the scan, click: Yes.

GooredFix checks for infections, and, when done, a log appears.

Please post the Goored.txt log (found on the Desktop) in your reply.


Next, download SASSafeRun to a USB flash drive using a clean computer:
http://www.superantispyware.com/dow...

(SASSafeRun is a portable launcher that can be stored and run directly from a USB Flash Drive.)

If the file does not download, copy/paste the following >>without the brackets<< to the address bar of your browser:
[http://www.superantispyware.com/downloads/SASSAFERUN.COM]

~~~~
Disconnect the infected computer form the DSL or cable connection.

~~~~
Now, start the computer.
Tap the F8 key before Windows starts, to bring up the Windows Advanced Options menu

Use the arrow keys to select Safe Mode

Press: Enter

~~~~
Plug in the USB flash drive in the infected computer, and double-click SASSafeRun.com

Start SuperAntiSpyware, and select:
‘Scan your computer’ > ‘Perform a Complete Scan’

OWhen done, on the main screen, click on the Preferences button.
Click on the Statistics/Logs tab
Double-click on the most current log.

>>Please provide the SuperAntiSpyware log in your reply.<<

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#12
July 15, 2011 at 20:50:19

Let’s also take a look at the HOSTS file:

1: Go to C:\Windows\System32\Drivers\etc folder.
2: Look for a file named "Hosts"
3: Right click the file and open it with Notepad
4. Copy the info

Please provide the contents of the HOSTS file in your reply.

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#13
July 18, 2011 at 07:42:42

aaflac44,

I have redirection problems with both, firefox and internet explorer. I don´t use a router.
Here is the Gooredfix log:

GooredFix by jpshortstuff (03.07.10.1)
Log created at 10:46 on 18/07/2011 (Fki User)
Firefox version 5.0 (sv-SE)

========== GooredScan ==========


========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [07:40 13/10/2009]
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [10:14 12/07/2011]

C:\Documents and Settings\Fki User\Application Data\Mozilla\Firefox\Profiles\vjifhrfo.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b} [07:19 10/09/2010]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [08:07 17/08/2009]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [08:14 16/07/2009]

-=E.O.F=-


Report •

#14
July 18, 2011 at 07:53:34

I downloaded the SASSafeRun file on a clean computer and ran it in safe-mode as directed. The tool found several tracking cookies and other two infections and asked me to reboot the system. I re-started in safe-mode and made the mistake of opening SAS from the SASSafeRun file again. I am afraid I overwrote the log files, as the log list is empty and the log files can't be found! However, I recall that the infections were found in the local settings/Temp/ folder, in files called explorer.exe and iexplorer.exe. The latter was infected with Trojan.Downloader-IExplore/Fake, if I recall correctly.

Even after removing these infections, I keep being redirected. I attach the hosts file as requested:

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

209.172.52.73 www.google.com
209.172.52.74 search.yahoo.com
209.172.52.74 www.bing.com


Report •

#15
July 18, 2011 at 12:51:20

>>Was the infected atapi.sys replaced?<<

Do you have the log that shows the atapi.sys infection? If so, can you post it?

BTW, GooredFix is showing legit extensions.

So, let's press on...

Please download SystemLook:
http://jpshortstuff.247fixes.com/Sy...

Save to your Desktop
Double-click SystemLook.exe to run it.
Copy the code below into the main text field:

:filefind  
atapi*


Click the ‘Look’ button to start the scan.

When finished, a Notepad window opens with the results of the scan.
The log is also found on your Desktop entitled: SystemLook.txt

>>Please post the log in your reply.<<


Also download aswMBR:
http://public.avast.com/~gmerek/asw...

Save to your Desktop
Double click aswMBR.exe to run it
Click the ‘Scan’ button

Note: Do not take action against any **Rootkit** entries!!

Once the scan finishes click ‘Save log’ to save the log to your Desktop

>>Please post the log in your reply.<<

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#16
July 19, 2011 at 04:01:23

aaflac44,

I still have the log showing the atapi.sys infection. I attach it:
2011/07/12 10:09:46.0250 0124 TDSS rootkit removing tool 2.5.9.0 Jul 1 2011 18:45:21
2011/07/12 10:09:46.0281 0124 ================================================================================
2011/07/12 10:09:46.0281 0124 SystemInfo:
2011/07/12 10:09:46.0281 0124
2011/07/12 10:09:46.0281 0124 OS Version: 5.1.2600 ServicePack: 3.0
2011/07/12 10:09:46.0281 0124 Product type: Workstation
2011/07/12 10:09:46.0281 0124 ComputerName: FKIXXX
2011/07/12 10:09:46.0281 0124 UserName: Fki User
2011/07/12 10:09:46.0281 0124 Windows directory: C:\WINDOWS
2011/07/12 10:09:46.0281 0124 System windows directory: C:\WINDOWS
2011/07/12 10:09:46.0281 0124 Processor architecture: Intel x86
2011/07/12 10:09:46.0281 0124 Number of processors: 2
2011/07/12 10:09:46.0281 0124 Page size: 0x1000
2011/07/12 10:09:46.0281 0124 Boot type: Normal boot
2011/07/12 10:09:46.0281 0124 ================================================================================
2011/07/12 10:09:48.0656 0124 Initialize success
2011/07/12 10:09:52.0578 0164 ================================================================================
2011/07/12 10:09:52.0578 0164 Scan started
2011/07/12 10:09:52.0578 0164 Mode: Manual;
2011/07/12 10:09:52.0578 0164 ================================================================================
2011/07/12 10:09:57.0203 0164 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/07/12 10:09:57.0531 0164 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/07/12 10:09:58.0296 0164 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/07/12 10:09:58.0578 0164 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/07/12 10:10:01.0140 0164 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/07/12 10:10:01.0609 0164 atapi (7a1fc04cc4607ced18e2d5520bee74b7) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/07/12 10:10:01.0609 0164 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\atapi.sys. Real md5: 7a1fc04cc4607ced18e2d5520bee74b7, Fake md5: 9f3a2f5aa6875c72bf062c712cfa2674
2011/07/12 10:10:01.0609 0164 atapi - detected Rootkit.Win32.TDSS.tdl3 (0)
2011/07/12 10:10:02.0046 0164 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/07/12 10:10:02.0296 0164 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/07/12 10:10:02.0718 0164 b57w2k (3a3a82ffd268bcfb7ae6a48cecf00ad9) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
2011/07/12 10:10:03.0015 0164 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/07/12 10:10:03.0484 0164 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/07/12 10:10:04.0078 0164 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/07/12 10:10:04.0328 0164 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/07/12 10:10:04.0546 0164 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/07/12 10:10:06.0234 0164 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/07/12 10:10:06.0875 0164 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/07/12 10:10:07.0343 0164 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/07/12 10:10:07.0718 0164 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/07/12 10:10:08.0031 0164 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/07/12 10:10:08.0671 0164 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/07/12 10:10:09.0000 0164 eeCtrl (5461f01b7def17dc90d90b029f874c3b) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/07/12 10:10:09.0250 0164 EraserUtilRebootDrv (17fcc372d03ba39f3aee85198c0ec594) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
2011/07/12 10:10:09.0718 0164 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/07/12 10:10:10.0125 0164 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/07/12 10:10:10.0625 0164 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/07/12 10:10:10.0859 0164 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/07/12 10:10:11.0187 0164 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/07/12 10:10:11.0687 0164 fssfltr (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
2011/07/12 10:10:12.0000 0164 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/07/12 10:10:12.0390 0164 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/07/12 10:10:12.0765 0164 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/07/12 10:10:13.0250 0164 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/07/12 10:10:13.0843 0164 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/07/12 10:10:15.0015 0164 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys
2011/07/12 10:10:15.0843 0164 ialm (0f0194c4b635c10c3f785e4fee52d641) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/07/12 10:10:17.0234 0164 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/07/12 10:10:18.0203 0164 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/07/12 10:10:18.0687 0164 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/07/12 10:10:19.0250 0164 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/07/12 10:10:19.0812 0164 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/07/12 10:10:20.0125 0164 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/07/12 10:10:20.0640 0164 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/07/12 10:10:20.0968 0164 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/07/12 10:10:21.0375 0164 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/07/12 10:10:21.0671 0164 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/07/12 10:10:21.0937 0164 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/07/12 10:10:22.0281 0164 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/07/12 10:10:22.0593 0164 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/07/12 10:10:22.0890 0164 Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
2011/07/12 10:10:23.0125 0164 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
2011/07/12 10:10:23.0328 0164 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/07/12 10:10:23.0484 0164 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/07/12 10:10:23.0656 0164 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/07/12 10:10:23.0781 0164 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/07/12 10:10:23.0906 0164 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/07/12 10:10:24.0187 0164 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/07/12 10:10:24.0687 0164 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/07/12 10:10:25.0234 0164 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/07/12 10:10:25.0609 0164 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/07/12 10:10:25.0921 0164 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/07/12 10:10:26.0078 0164 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/07/12 10:10:26.0515 0164 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/07/12 10:10:26.0828 0164 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/07/12 10:10:27.0328 0164 NAVENG (920d9701bba90dbb7ccfd3536ea4d6f9) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110703.003\naveng.sys
2011/07/12 10:10:28.0515 0164 NAVEX15 (31b1a9b53c3319b97f7874347cd992d2) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20110703.003\navex15.sys
2011/07/12 10:10:29.0109 0164 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/07/12 10:10:29.0875 0164 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/07/12 10:10:30.0468 0164 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/07/12 10:10:31.0187 0164 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/07/12 10:10:31.0890 0164 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/07/12 10:10:32.0343 0164 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/07/12 10:10:32.0843 0164 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/07/12 10:10:33.0281 0164 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/07/12 10:10:34.0125 0164 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/07/12 10:10:35.0218 0164 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/07/12 10:10:35.0875 0164 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/07/12 10:10:36.0625 0164 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/07/12 10:10:37.0250 0164 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/07/12 10:10:37.0703 0164 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/07/12 10:10:38.0140 0164 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/07/12 10:10:38.0828 0164 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/07/12 10:10:39.0531 0164 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/07/12 10:10:40.0031 0164 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/07/12 10:10:41.0968 0164 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/07/12 10:10:42.0343 0164 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/07/12 10:10:42.0734 0164 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/07/12 10:10:43.0109 0164 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/07/12 10:10:44.0921 0164 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/07/12 10:10:45.0343 0164 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/07/12 10:10:45.0828 0164 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/07/12 10:10:46.0375 0164 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/07/12 10:10:46.0812 0164 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/07/12 10:10:47.0296 0164 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/07/12 10:10:47.0765 0164 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/07/12 10:10:48.0109 0164 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/07/12 10:10:48.0468 0164 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/07/12 10:10:48.0812 0164 SAVRT (12b6e269ef8ac8ea36122544c8a1b6d8) C:\Program Files\Symantec AntiVirus\savrt.sys
2011/07/12 10:10:49.0187 0164 SAVRTPEL (97e5b6f3f95465e1f59360b59d8ec64e) C:\Program Files\Symantec AntiVirus\Savrtpel.sys
2011/07/12 10:10:49.0671 0164 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/07/12 10:10:50.0546 0164 senfilt (b9c7617c1e8ab6fdff75d3c8dafcb4c8) C:\WINDOWS\system32\drivers\senfilt.sys
2011/07/12 10:10:51.0937 0164 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/07/12 10:10:52.0500 0164 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/07/12 10:10:53.0078 0164 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/07/12 10:10:54.0125 0164 smwdm (c6d9959e493682f872a639b6ec1b4a08) C:\WINDOWS\system32\drivers\smwdm.sys
2011/07/12 10:10:55.0640 0164 SPBBCDrv (ef9760a364d836a0ce6149ebdf71524d) C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
2011/07/12 10:10:56.0593 0164 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/07/12 10:10:57.0359 0164 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/07/12 10:10:58.0156 0164 Srv (da852e3e0bf1cea75d756f9866241e57) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/07/12 10:10:58.0937 0164 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
2011/07/12 10:10:59.0343 0164 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/07/12 10:10:59.0812 0164 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/07/12 10:11:00.0781 0164 SymEvent (49b20b430a4f219173f823536944474a) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
2011/07/12 10:11:01.0203 0164 SYMREDRV (626f733be7f951116c5c0804b068666c) C:\WINDOWS\System32\Drivers\SYMREDRV.SYS
2011/07/12 10:11:01.0625 0164 SYMTDI (cb7cc4ddbe09e224d4cd876760ba982c) C:\WINDOWS\System32\Drivers\SYMTDI.SYS
2011/07/12 10:11:02.0625 0164 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/07/12 10:11:03.0171 0164 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/07/12 10:11:03.0656 0164 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/07/12 10:11:04.0156 0164 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/07/12 10:11:04.0359 0164 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/07/12 10:11:04.0875 0164 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/07/12 10:11:05.0734 0164 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/07/12 10:11:06.0156 0164 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/07/12 10:11:06.0484 0164 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/07/12 10:11:07.0015 0164 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/07/12 10:11:07.0421 0164 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/07/12 10:11:07.0750 0164 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/07/12 10:11:08.0046 0164 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/07/12 10:11:09.0078 0164 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/07/12 10:11:09.0500 0164 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/07/12 10:11:10.0062 0164 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/07/12 10:11:10.0171 0164 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/07/12 10:11:13.0453 0164 Boot (0x1200) (3f46bf999b7e42fc506c766e973dbec6) \Device\Harddisk0\DR0\Partition0
2011/07/12 10:11:13.0468 0164 ================================================================================
2011/07/12 10:11:13.0468 0164 Scan finished
2011/07/12 10:11:13.0468 0164 ================================================================================
2011/07/12 10:11:13.0484 0156 Detected object count: 1
2011/07/12 10:11:13.0484 0156 Actual detected object count: 1
2011/07/12 10:11:31.0375 0156 atapi (7a1fc04cc4607ced18e2d5520bee74b7) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/07/12 10:11:31.0375 0156 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\atapi.sys. Real md5: 7a1fc04cc4607ced18e2d5520bee74b7, Fake md5: 9f3a2f5aa6875c72bf062c712cfa2674
2011/07/12 10:11:45.0062 0156 Backup copy found, using it..
2011/07/12 10:11:45.0234 0156 C:\WINDOWS\system32\DRIVERS\atapi.sys - will be cured after reboot
2011/07/12 10:11:45.0234 0156 Rootkit.Win32.TDSS.tdl3(atapi) - User select action: Cure
2011/07/12 10:12:46.0078 0684 Deinitialize success


Report •

#17
July 19, 2011 at 04:03:16

Here is also the SystemLook log:
SystemLook 04.09.10 by jpshortstuff
Log created at 12:36 on 19/07/2011 by Fki User
Administrator - Elevation successful

========== filefind ==========

Searching for "atapi*"
C:\cmdcons\ATAPI.SY_ --a---- 49558 bytes [20:59 03/08/2004] [20:59 03/08/2004] 28541D14647BB58502D09D1CEAEE6684
C:\MGtools\temp\ERDNT\atapi.sys --a---- 96512 bytes [15:21 12/07/2011] [08:13 12/07/2011] 9F3A2F5AA6875C72BF062C712CFA2674
C:\MGtools\temp\NTSPU\atapi.sys --a---- 95360 bytes [15:21 12/07/2011] [21:59 03/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51
C:\MGtools\temp\SPF\atapi.sys --a---- 96512 bytes [15:21 12/07/2011] [18:40 13/04/2008] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\$NtServicePackUninstall$\atapi.sys -----c- 95360 bytes [08:00 01/09/2009] [21:59 03/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51
C:\WINDOWS\ERDNT\cache\atapi.sys --a---- 96512 bytes [15:01 12/07/2011] [08:13 12/07/2011] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\ServicePackFiles\i386\atapi.sys ------- 96512 bytes [18:11 08/02/2008] [18:40 13/04/2008] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\drivers\atapi.sys --a---- 96512 bytes [12:07 08/02/2008] [08:13 12/07/2011] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys --a---- 86912 bytes [12:07 08/02/2008] [12:00 31/03/2003] 95B858761A00E1D4F81F79A0DA019ACA
C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys --a---- 86912 bytes [12:07 08/02/2008] [00:27 29/08/2002] 95B858761A00E1D4F81F79A0DA019ACA

-= EOF =-


Report •

#18
July 19, 2011 at 04:05:04

and the aswMBR log:
aswMBR version 0.9.7.777 Copyright(c) 2011 AVAST Software
Run date: 2011-07-19 12:40:40
-----------------------------
12:40:40.125 OS Version: Windows 5.1.2600 Service Pack 3
12:40:40.125 Number of processors: 2 586 0x403
12:40:40.125 ComputerName: FKIXXX UserName:
12:40:40.890 Initialize success
12:42:14.578 AVAST engine defs: 11071900
12:42:24.390 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e
12:42:24.390 Disk 0 Vendor: WDC_WD800JD-75MSA1 10.01E01 Size: 76293MB BusType: 3
12:42:24.406 Disk 0 MBR read successfully
12:42:24.406 Disk 0 MBR scan
12:42:24.531 Disk 0 Windows XP default MBR code
12:42:24.531 Disk 0 scanning sectors +156232125
12:42:24.625 Disk 0 scanning C:\WINDOWS\system32\drivers
12:42:39.687 Service scanning
12:42:41.484 Disk 0 trace - called modules:
12:42:41.500 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
12:42:41.500 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86d69ab8]
12:42:41.500 3 CLASSPNP.SYS[f75befd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-e[0x86dcdaa8]
12:42:42.000 AVAST engine scan C:\WINDOWS
12:42:55.078 AVAST engine scan C:\WINDOWS\system32
12:45:20.500 AVAST engine scan C:\WINDOWS\system32\drivers
12:45:33.906 AVAST engine scan C:\Documents and Settings\Fki User
12:58:18.078 AVAST engine scan C:\Documents and Settings\All Users
12:58:39.796 Scan finished successfully
13:05:08.078 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Fki User\Desktop\MBR.dat"
13:05:08.093 The log file has been saved successfully to "C:\Documents and Settings\Fki User\Desktop\aswMBR.txt"

Thank you very much for your help!


Report •

#19
July 19, 2011 at 10:48:11

vagmo,

Note: Kaspersky Online Scanner detects existing anti-virus software. You need to disable the real-time protection components of your existing anti-virus to run the scan.

Just remember to turn the program back on when finished.

How To Temporarily Disable Your Anti-virus http://www.bleepingcomputer.com/for...

Please perform a scan with the Kaspersky Online Virus Scanner: http://www.kaspersky.com/kos/eng/pa...

Requires free Java Runtime Environment (JRE)e installed before scanning:
http://www.java.com/en/download/ind...

This scan does not remove any detected file threats, but shows where they are located, so they can be cleaned with other tools.

Vista users need to right-click the IE or FF browser icon and select: Run As Administrator
http://vistasupport.mvps.org/run_as...

Read the "Advantages - Requirements and Limitations" then press the ’Accept’ button.

You are prompted to install an application from Kaspersky.
Click the ‘Run’ button.
It starts downloading and installing the scanner and virus definitions.

When the downloads have finished, you should see 'Database is updated. Ready to scan'.

Click on the ‘Settings’ button.
Make sure these boxes are checked. By default, they should be. If not, please check them and click on the ’Save’ button afterwards:

Detect malicious programs of the following categories:
-Viruses, Worms, Trojan Horses, Rootkits
-Spyware, Adware, Dialers and other potentially dangerous programs

Scan compound files (doesn't apply to the File scan area):
-Archives
-Mail databases


Click on My Computer under the Scan section.
OK any warnings from your protection programs.

The scan takes a while, so be patient and do NOT use the computer while the scan is running. Keep all other programs and windows closed.

Once the scan is complete (the 'status' will show complete), click on ‘View Scan Report’, and any infected objects are shown.

Click on ‘Save Report As…’ and change the Files of type to: ‘Text file (.txt)’

Name the file KAVScan_ddmmyy (day, month, year) before clicking on the Save button and save it to your Desktop.

Please copy/paste (Ctrl+C) the saved scan results and post in your reply.


~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#20
July 20, 2011 at 07:47:05

aaflac44,
I turned off my real time protection and tried to run the kaspersky online scanner. However, after the virus definitions were updated, the program stopped and showed an error message saying "licence expired". I tried to re-run the program, but I still got the same message. Hours later I tried again and this time the file was not found (error 404). I assume the Online Scanner is not working at the moment, unless i am being blocked to access the kaspersky site. I'll try again in a few hours and let you know the results.

Report •

#21
July 20, 2011 at 16:38:38

kaspersky online scanner

http://www.google.com.au/#hl=en&xhr...

http://www.kaspersky.com/virusscanner

Coming soon:
A new, improved version of the Kaspersky Online Scanner

We apologize for the inconvenience, but the Kaspersky Online Scanner is currently unavailable - In the meantime, take advantage of a free trial of Kaspersky Internet Security 2012, which has everything you need to keep your computer safe.


Report •

#22
July 20, 2011 at 19:30:25
✔ Best Answer

Thanks for the info, Johnw!

Now I can't get to it either.

vagmo,

Let’s try the EsetOnlineScanner, and see what kind of results we get from it.

First, temporarily disable your antivirus program , so that it does not interfere.

Note: This scan requires Internet Explorer,Opera or Firefox to work. Vista/Windows 7 users need to run Internet Explorer as Administrator.
To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run As Administrator from the context menu.

Then, download the esetsmartinstaller_enu.exe installer http://download.eset.com/special/eo...
Click the file to run the EsetOnlineScanner.

If you accept the Terms of Use, check the box and click: Start
It takes a couple minutes for the scanner to get ready.

When the Computer scan settings appear, check the following boxes:

Remove found threats
Scan unwanted applications

Next to 'Current scan targets: Operating memory, Local drives', click: Change Make sure you place a check next to all disk drives, including any external drives that are attached (no need to check off the floppy or DVD/CDROM drives).

Now, click the Advanced option, then, place a check next to the following (if it is not already checked):

Enable Anti-Stealth technology

Click Start.

This scan may take a while, so please be patient.

A log opens when the scan is complete (If not, go to C:\Program Files\EsetOnlineScanner\ and open the file log.txt).

Click Edit > Select All, and copy/paste the Eset log in your reply.

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#23
July 21, 2011 at 02:23:19

aaflac44,

I ran the Eset scanner and got the following results. It finds an infection in the txt version of the host I prepared for posting before as well as in the original hosts file.

Here the log:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=9297d1cec1759647b6d044e0c2eee4c0
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-07-21 09:22:14
# local_time=2011-07-21 11:22:14 (+0100, W. Europe Daylight Time)
# country="Sweden"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=6143 16777215 0 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 239 239 0 0
# scanned=77304
# found=5
# cleaned=5
# scan_time=3774
C:\Documents and Settings\Fki User\Desktop\logs compunet\hosts.txt Win32/Qhost trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Fki User\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{41011E47-E063-4361-95C8-F274806C1E37} Win32/Qhost trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\config\systemprofile\Application Data\D26B775A81F299665FAA100B7B5AC647\enemies-names.txt Win32/Adware.AntimalwareDoctor.AE.Gen application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\config\systemprofile\Application Data\D26B775A81F299665FAA100B7B5AC647\local.ini Win32/Adware.AntimalwareDoctor.AE.Gen application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\drivers\etc\hosts Win32/Qhost trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C


Report •

#24
July 21, 2011 at 02:39:56

I have peformed a couple of searchs in google using both firefox and iexplorer without being redirected! So far, it seems the problem has been fixed!

Report •

#25
July 21, 2011 at 03:27:34

Hi aaflac44, I don't use the hosts file myself, if you prefer to use them, no worries.
vagm's computer does not appear to have enough preventive security in place.

I rename Hosts file & use SpywareBlaster.
Do a search for the hosts file ( In Windows\system32\drivers\etc ) & rename to > hosts.txt or hostsold.

Here is what I base my decision on.

Hosts File
http://home.comcast.net/~SupportCD/...
Myth - "Special AntiSpyware Hosts Files are necessary to prevent Spyware infections."
Reality - "Using Special AntiSpyware Hosts Files are a waste of time and leads to a false sense of security.


Report •

#26
July 21, 2011 at 09:05:50

Hi, Johnw!

Thanks for jumping in. It is always good to get a helpful perspective on these issues.

SpywareBlaster is a well known, tested and tried program.

It would be to your advantage to download it, vagmo:

http://www.javacoolsoftware.com/spy...

The program protects your system from being misdirected to undesirable websites. Keeping SB updated will maintain a current list of bad sites, and automatically block the system from accessing them.

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •

#27
July 22, 2011 at 01:37:33

aaflac44,

Thank you very much for your help and advice. I have installed SpywareBlaster as recommended. My computer is now working fine and I can use google without problems.

Thanks for your help!


Report •

#28
July 22, 2011 at 09:53:29

Thanks to Johnw for his input.

Glad to help, vagmo!!

Have a great weekend.

~~~~
Retired - Doin' Dis, Dat, and slapping malware.


Report •


Ask Question