Active System running 65% on startup after Windos update.

[Active] System running 65% on startup after Windos update.

Noticed searchfilterhost.exe using 26Mb.

Here are the DDS logs.

<SNIP>

 

Shall do, but on the off chance it was Malware, I'm running Malbytes, and it's found 2 infected objects. So if you don't mind, I'll post that log when the scan is complete, and see what happens.

 

Malwarebytes' Anti-Malware 1.40
Database version: 2611
Windows 5.1.2600 Service Pack 3

8/12/2009 1:22:40 PM
mbam-log-2009-08-12 (13-22-40).txt

Scan type: Full Scan (C:\|)
Objects scanned: 312292
Time elapsed: 2 hour(s), 15 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ( "%1" /S) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1 ") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

Now AVG is posting threats for Trojan horse infector.Fh and Rootkit.Pakes
AVG won't remove them
and IE window keeps closing with SVChost error.


With apologies Arie...but this IS virus.

 

Yes Broni, my personal machine.


DDS (Ver_09-07-30.01) - NTFSx86
Run by Rosemary at 6:33:41.14 on Thu 08/13/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2045.1297 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\WINDOWS\system32\msword98.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Documents and Settings\Rosemary\msword98.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Rosemary\msword98.exe
C:\WINDOWS\9129837.exe
C:\WINDOWS\System32\svchost.exe
svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rsvp.exe
C:\WINDOWS\System32\svchost.exe
svchost.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Documents and Settings\Rosemary\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.goodsearch.com/
uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No File
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
uRun: [PxDotNetLoader] "c:\program files\fidelity investments\fidelity active trader\system\ATPStartupAssistant.exe "
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [msword98] c:\documents and settings\rosemary\msword98.exe
uRun: [braviax]
uRun: [ttool] c:\windows\9129837.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe "
mRun: [IntelAudioStudio] "c:\program files\intel audio studio\IntelAudioStudio.exe" TRAY
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe "
mRun: [CCUTRAYICON] c:\program files\intel\inteldh\ccu\CCU_TrayIcon.exe
mRun: [NMSSupport] "c:\program files\common files\intel\inteldh\nms\support\IntelHCTAgent.exe" /startup
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [<NO NAME>]
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe "
mRun: [msword98] c:\windows\system32\msword98.exe
mRun: [braviax]
mRun: [Regedit32] c:\windows\system32\regedit.exe
mRunServices: [ZipMagic] c:\program files\ontrack\zipmagic\zm32nt.exe
dRun: [braviax]
StartupFolder: c:\documents and settings\rosemary\start menu\programs\startup\ikowin32.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: turbotax.com
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://echat.bellsouth.net/sdccommon/download/tgctlcm.cab
DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
DPF: {2703049B-D81D-4763-A3C6-AF8932FCBD8F} - hxxps://am.hrblock.com/ActivexComponent/CheckFileStatus.CAB
DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} - hxxp://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1182539247843
DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1182539214796
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab
DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} - hxxp://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7}
Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks 2009\HelpAsyncPluggableProtocol.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Handler: x-atng - {7e8717b0-d862-11d5-8c9e-00010304f989} - c:\program files\fidelity investments\fidelity active trader\system\atngprot.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: cru629.dat
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-2 64160]
R0 zmNTMon;zmNTMon;c:\windows\system32\drivers\ZmNTMon.sys [2007-12-3 5760]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-4 335752]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-6-23 27784]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-5-4 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-7-5 298776]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-10-10 13088]
R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-3-18 600944]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-3-18 600944]
R2 MCLServiceATL;Intel(R) Application Tracker;c:\program files\intel\inteldh\intel media server\shells\MCLServiceATL.exe [2006-11-10 170456]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-7-5 907032]
S2 ioloProductUpdate;iolo Product Update Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-3-18 600944]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
S3 zmNTZip;zmNTZip;c:\program files\ontrack\zipmagic\zmNTZip.sys [2007-12-3 155576]

============== File Associations ===============

JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1

=============== Created Last 30 ================

2009-08-13 06:29 10,240 a------- c:\windows\system32\braviax.exe
2009-08-13 06:27 28,160 a------- c:\windows\system32\dllcache\figaro.sys
2009-08-12 18:35 146 a------- c:\documents and settings\rosemary\delself.bat
2009-08-12 18:34 10,240 a------- c:\windows\braviax.exe
2009-08-12 18:34 6,144 a------- c:\windows\system32\cru629.dat
2009-08-12 18:34 6,144 a------- c:\windows\cru629.dat
2009-08-12 18:32 <DIR> --d----- c:\windows\pss
2009-08-12 18:24 61,952 a------- c:\windows\9129837.exe
2009-08-12 18:24 26,686 a------- c:\windows\system32\msword98.exe
2009-08-12 18:24 26,686 a------- c:\documents and settings\rosemary\msword98.exe
2009-08-12 10:36 <DIR> --d----- c:\docume~1\rosemary\applic~1\Malwarebytes
2009-08-12 10:35 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-12 10:35 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-08-12 10:35 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-08-12 10:35 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-08-11 17:54 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll
2009-08-05 05:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-21 10:09 202,072 a----r-- c:\windows\system32\cpnprt2.cid
2009-07-17 15:01 58,880 -------- c:\windows\system32\dllcache\atl.dll
2009-07-15 10:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\GameHouse
2009-07-15 10:24 <DIR> --d----- c:\program files\Yahoo! Games

==================== Find3M ====================

2009-08-13 06:29 28,160 a------- c:\windows\system32\drivers\beep.sys
2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-18 12:05 3,069,440 -------- c:\windows\system32\dllcache\mshtml.dll
2009-07-18 12:05 1,509,888 -------- c:\windows\system32\dllcache\shdocvw.dll
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 23:43 10,841,088 a------- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-13 08:41 335,752 a------- c:\windows\system32\drivers\avgldx86.sys
2009-06-29 08:48 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-06-26 12:50 666,624 a------- c:\windows\system32\wininet.dll
2009-06-26 12:50 666,624 -------- c:\windows\system32\dllcache\wininet.dll
2009-06-26 12:50 620,032 -------- c:\windows\system32\dllcache\urlmon.dll
2009-06-26 12:50 81,920 a------- c:\windows\system32\ieencode.dll
2009-06-26 12:50 81,920 -------- c:\windows\system32\dllcache\ieencode.dll
2009-06-25 04:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 04:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 04:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 04:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 04:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 04:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-06-25 04:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll
2009-06-25 04:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll
2009-06-25 04:25 147,456 -------- c:\windows\system32\dllcache\schannel.dll
2009-06-25 04:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-06-25 04:25 56,832 -------- c:\windows\system32\dllcache\secur32.dll
2009-06-25 04:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll
2009-06-24 11:20 3,926,062 a------- c:\docume~1\rosemary\applic~1\family.zip
2009-06-24 07:18 92,928 a------- c:\windows\system32\drivers\ksecdd.sys
2009-06-24 07:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys
2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-16 10:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 10:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-12 08:31 80,896 a------- c:\windows\system32\tlntsess.exe
2009-06-12 08:31 80,896 -------- c:\windows\system32\dllcache\tlntsess.exe
2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-12 08:31 76,288 -------- c:\windows\system32\dllcache\telnet.exe
2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 10:13 84,992 -------- c:\windows\system32\dllcache\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\dllcache\mstscax.dll
2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-10 02:14 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll
2009-06-08 15:48 262,144 a------- C:\ntuser.dat
2009-06-03 15:09 1,291,264 -------- c:\windows\system32\quartz.dll
2009-06-03 15:09 1,291,264 -------- c:\windows\system32\dllcache\quartz.dll
2009-05-29 15:54 940,896 a------- c:\windows\system32\Incinerator.dll
2009-05-25 00:24 350,208 a------- c:\windows\system32\mssph.dll
2009-01-22 12:38 60,744 ac------ c:\documents and settings\rosemary\g2mdlhlpx.exe
2007-06-23 18:04 552 ac------ c:\docume~1\rosemary\applic~1\wklnhst.dat

============= FINISH: 6:34:44.12 ===============

 

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 6/22/2007 2:13:23 PM
System Uptime: 8/13/2009 6:26:04 AM (0 hours ago)

Motherboard: Intel Corporation | | D975XBX
Processor: Intel(R) Pentium(R) D CPU 3.20GHz | J3E1 | 3200/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 233 GiB total, 179.786 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable
J: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP744: 5/15/2009 11:25:08 AM - System Checkpoint
RP745: 5/16/2009 11:28:03 AM - System Checkpoint
RP746: 5/17/2009 11:30:56 AM - System Checkpoint
RP747: 5/18/2009 4:52:01 AM - Software Distribution Service 3.0
RP748: 5/19/2009 4:53:04 AM - System Checkpoint
RP749: 5/19/2009 9:24:29 AM - Avg8 Update
RP750: 5/19/2009 9:25:12 AM - Avg8 Update
RP751: 5/20/2009 10:48:24 AM - System Checkpoint
RP752: 5/21/2009 1:02:19 PM - System Checkpoint
RP753: 5/22/2009 2:13:47 PM - System Checkpoint
RP754: 5/23/2009 3:06:54 PM - System Checkpoint
RP755: 5/24/2009 3:53:46 PM - System Checkpoint
RP756: 5/25/2009 5:03:45 PM - System Checkpoint
RP757: 5/26/2009 6:51:49 PM - System Checkpoint
RP758: 5/27/2009 7:06:09 PM - System Checkpoint
RP759: 5/28/2009 7:10:55 PM - System Checkpoint
RP760: 5/29/2009 7:16:10 PM - System Checkpoint
RP761: 5/30/2009 8:15:47 PM - System Checkpoint
RP762: 5/31/2009 8:16:55 PM - System Checkpoint
RP763: 6/1/2009 4:20:51 PM - Installed Fidelity Active Trader Pro®.
RP764: 6/1/2009 4:21:41 PM - Installed Fidelity Active Trader Pro®.
RP765: 6/1/2009 4:22:46 PM - Removed Fidelity Active Trader Pro®.
RP766: 6/2/2009 4:26:59 PM - System Checkpoint
RP767: 6/3/2009 5:14:17 PM - System Checkpoint
RP768: 6/4/2009 5:49:52 PM - System Checkpoint
RP769: 6/5/2009 6:50:53 PM - System Checkpoint
RP770: 6/6/2009 8:26:15 PM - System Checkpoint
RP771: 6/7/2009 9:14:14 PM - System Checkpoint
RP772: 6/8/2009 4:52:25 PM - Installed ProSeries Basic Edition 2007
RP773: 6/8/2009 4:54:10 PM - Installed AnswerWorks 4.0 Runtime - English
RP774: 6/8/2009 5:06:17 PM - Installed ProSeries Basic Edition 2007
RP775: 6/8/2009 5:07:03 PM - Installed ProSeries Basic User's Guide 2007
RP776: 6/8/2009 5:07:40 PM - Installed AnswerWorks 4.0 Runtime - English
RP777: 6/8/2009 5:24:52 PM - Removed ProSeries Basic User's Guide 2007
RP778: 6/9/2009 5:44:12 PM - Software Distribution Service 3.0
RP779: 6/9/2009 6:18:59 PM - Printer Driver Microsoft XPS Document Writer Installed
RP780: 6/10/2009 6:47:18 PM - System Checkpoint
RP781: 6/11/2009 6:48:23 PM - System Checkpoint
RP782: 6/12/2009 6:59:18 PM - System Checkpoint
RP783: 6/12/2009 7:27:00 PM - Software Distribution Service 3.0
RP784: 6/13/2009 8:23:10 PM - System Checkpoint
RP785: 6/14/2009 8:44:56 PM - System Checkpoint
RP786: 6/15/2009 9:36:21 PM - System Checkpoint
RP787: 6/16/2009 10:02:15 PM - System Checkpoint
RP788: 6/17/2009 11:02:15 PM - System Checkpoint
RP789: 6/18/2009 11:59:16 PM - System Checkpoint
RP790: 6/20/2009 12:41:33 AM - System Checkpoint
RP791: 6/21/2009 1:07:34 AM - System Checkpoint
RP792: 6/22/2009 5:26:38 AM - System Checkpoint
RP793: 6/23/2009 6:35:45 AM - System Checkpoint
RP794: 6/24/2009 7:01:34 AM - System Checkpoint
RP795: 6/25/2009 7:49:21 AM - System Checkpoint
RP796: 6/26/2009 7:55:03 AM - System Checkpoint
RP797: 6/27/2009 8:27:27 AM - System Checkpoint
RP798: 6/28/2009 8:38:46 AM - System Checkpoint
RP799: 6/29/2009 8:47:22 AM - Avg8 Update
RP800: 6/29/2009 8:48:27 AM - Avg8 Update
RP801: 6/30/2009 9:03:39 AM - System Checkpoint
RP802: 7/1/2009 9:21:40 AM - System Checkpoint
RP803: 7/2/2009 10:30:44 AM - System Checkpoint
RP804: 7/3/2009 11:40:05 AM - System Checkpoint
RP805: 7/4/2009 12:28:03 PM - System Checkpoint
RP806: 7/5/2009 1:16:04 PM - System Checkpoint
RP807: 7/6/2009 1:38:24 PM - System Checkpoint
RP808: 7/7/2009 2:32:08 PM - System Checkpoint
RP809: 7/8/2009 2:40:04 PM - System Checkpoint
RP810: 7/9/2009 3:16:05 PM - System Checkpoint
RP811: 7/10/2009 8:48:59 AM - Software Distribution Service 3.0
RP812: 7/11/2009 9:52:50 AM - System Checkpoint
RP813: 7/12/2009 10:43:28 AM - System Checkpoint
RP814: 7/13/2009 8:40:42 AM - Avg8 Update
RP815: 7/13/2009 8:41:30 AM - Avg8 Update
RP816: 7/14/2009 9:13:16 AM - System Checkpoint
RP817: 7/14/2009 1:50:59 PM - Software Distribution Service 3.0
RP818: 7/15/2009 2:13:16 PM - System Checkpoint
RP819: 7/16/2009 2:42:43 PM - System Checkpoint
RP820: 7/17/2009 9:55:54 AM - Avg8 Update
RP821: 7/18/2009 10:37:16 AM - System Checkpoint
RP822: 7/19/2009 11:01:45 AM - System Checkpoint
RP823: 7/20/2009 12:12:30 PM - System Checkpoint
RP824: 7/21/2009 1:21:15 PM - System Checkpoint
RP825: 7/22/2009 1:41:31 PM - System Checkpoint
RP826: 7/23/2009 1:44:58 PM - System Checkpoint
RP827: 7/24/2009 2:11:35 PM - System Checkpoint
RP828: 7/25/2009 3:19:44 PM - System Checkpoint
RP829: 7/26/2009 3:45:24 PM - System Checkpoint
RP830: 7/27/2009 5:15:21 PM - System Checkpoint
RP831: 7/28/2009 6:02:21 PM - System Checkpoint
RP832: 7/29/2009 6:22:17 PM - Software Distribution Service 3.0
RP833: 7/30/2009 9:18:27 AM - Software Distribution Service 3.0
RP834: 7/30/2009 8:11:23 PM - Software Distribution Service 3.0
RP835: 7/31/2009 8:17:26 PM - System Checkpoint
RP836: 8/1/2009 9:14:13 PM - System Checkpoint
RP837: 8/2/2009 11:00:02 PM - System Checkpoint
RP838: 8/3/2009 11:38:13 PM - System Checkpoint
RP839: 8/5/2009 5:26:15 AM - System Checkpoint
RP840: 8/6/2009 5:47:31 AM - System Checkpoint
RP841: 8/7/2009 6:16:14 AM - System Checkpoint
RP842: 8/8/2009 6:38:15 AM - System Checkpoint
RP843: 8/9/2009 7:14:38 AM - System Checkpoint
RP844: 8/10/2009 8:47:17 AM - System Checkpoint
RP845: 8/11/2009 11:53:08 AM - System Checkpoint
RP846: 8/12/2009 7:59:12 AM - Software Distribution Service 3.0

==== Installed Programs ======================


2000 TurboTax for Windows
7200
7200_Help
7200Trb
Acrobat.com
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Photoshop 7.0
Adobe Product/Adobe Studio Update 10/2001
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Reader 8.1.6
Advanced Analyzer
AiO_Scan
AiOSoftware
AnswerWorks 4.0 Runtime - English
AnswerWorks 5.0 English Runtime
ATI Display Driver
Avery Wizard 3.1
AVG 8.5
Broderbund Media Manager
BufferChm
Compatibility Pack for the 2007 Office system
Copy
Coupon Printer for Windows
CP_AtenaShokunin1Config
cp_dwShrek2Albums1
cp_dwShrek2Cards1
CreativeProjects
CreativeProjectsTemplates
Critical Update for Windows Media Player 11 (KB959772)
CueTour
Destinations
Director
DocProc
DocumentViewer
doPDF 5.0 printer
EasyCleaner
Fax
Fidelity Active Trader Pro®
Google Earth
Google Updater
GoToMeeting 4.0.0.320
High Definition Audio Driver Package - KB888111
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
HP Extended Capabilities 4.7
HP Image Zone 4.7
HP Officejet 7200 series
HP Product Assistant
HP Product Detection
HP PSC & OfficeJet 4.7
HP Update
HPSystemDiagnostics
InstantShare
Intel Audio Studio 2.0
Intel(R) Matrix Storage Manager
Intel(R) PRO Network Connections Drivers
Intel(R) Quick Resume Technology Drivers
Intel® Viiv™ Software
Intuit Entitlement Client
iolo technologies' System Mechanic Professional
ItsDeductible Express
Java 2 Runtime Environment, SE v1.4.1_02
Java Web Start
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
LaserJet 1020 series
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
MarketResearch
MediaShow 3.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Digital Image Library 9 - Blocker
Microsoft Digital Image Standard 2006
Microsoft Digital Image Standard 2006 Editor
Microsoft Digital Image Standard 2006 Library
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Office 2003 Primary Interop Assemblies
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft Streets & Trips 2006
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual Studio 2005 Tools for Office Runtime
Microsoft Web Publishing Wizard 1.52
Microsoft Works Suite 2006 Setup Launcher
mIRC
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
OIB4 Training Install Kit
Ontrack ZipMagic 4.0
OrchidWiz Encyclopedia
OrderReminder HP LaserJet 1020
PanoStandAlone
PCI SoftV92 Modem
Pdf995
PhotoGallery
PowerDVD
PowerProducer
PowerStarter
ProductContext
ProSeries Basic Edition 2007
QFolder
QuickBooks
QuickBooks Premier: Accountant Edition 2007
QuickBooks Pro 2009
Quicken 2007
QuoteTracker
Readme
RegScrubXP 3.25
SafeCast Shared Components
Scan
ScannerCopy
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Shockwave
SigmaTel Audio
SkinsHP1
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
SpywareBlaster 4.1
SupportSoft Assisted Service
TaxCut Premium + State + Efile 2008
Text Twist 2 (remove only)
The Print Shop
TrayApp
TurboTax 2008
TurboTax 2008 wgaiper
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wrapper
TurboTax Deluxe 2002
TurboTax Deluxe 2003
TurboTax Deluxe 2004
TurboTax Deluxe 2005
TurboTax Deluxe 2007
TurboTax Deluxe Deduction Maximizer 2006
TurboTax ItsDeductible 2005
TurboTax ItsDeductible 2006
Tweak UI
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB943729)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
Update Rollup 2 for Windows XP Media Center Edition 2005
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Visual Studio 2005 Tools for Office Second Edition Runtime
VNC 4.0
WebFldrs XP
WebReg
WexTech AnswerWorks
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows Search 4.0
Windows XP Media Center Edition 2005 KB908250
Windows XP Media Center Edition 2005 KB925766
Windows XP Service Pack 3
Works Upgrade
XML Paper Specification Shared Components Pack 1.0
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

8/12/2009 8:20:00 AM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
8/12/2009 8:19:03 AM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 0016761F508E has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
8/12/2009 6:41:12 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file ntfs.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.
8/12/2009 6:37:04 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the AVG Free8 E-mail Scanner service to connect.
8/12/2009 6:37:04 PM, error: Service Control Manager [7000] - The AVG Free8 E-mail Scanner service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/12/2009 12:09:26 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Search service to connect.
8/12/2009 12:09:26 AM, error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/12/2009 12:09:26 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
8/12/2009 12:06:30 AM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: An instance of the service is already running.
8/12/2009 12:06:00 AM, error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
8/12/2009 12:03:06 AM, error: Service Control Manager [7034] - The Intuit Update Service service terminated unexpectedly. It has done this 1 time(s).
8/12/2009 12:00:34 AM, error: Service Control Manager [7034] - The iolo System Service service terminated unexpectedly. It has done this 1 time(s).
8/12/2009 12:00:34 AM, error: Service Control Manager [7034] - The iolo FileInfoList Service service terminated unexpectedly. It has done this 1 time(s).
8/11/2009 12:29:38 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
8/11/2009 12:24:28 PM, error: Service Control Manager [7023] - The Intel(R) Quick Resume technology service terminated with the following error: The system could not find the environment option that was entered.
8/11/2009 12:24:19 PM, error: Service Control Manager [7023] - The HID Input Service service terminated with the following error: The system cannot find the file specified.
8/11/2009 12:24:19 PM, error: Service Control Manager [7000] - The iolo Product Update Service service failed to start due to the following error: The executable program that this service is configured to run in does not implement the service.

==== End Of File ===========================

 

Now AVG has found 2 trojans crypt.GKH
SHeur2.AWFL

 

Malwarebytes found 39 entries which I removed.

What can I do to prevent this attack? Other than have AVG installed and active?

Malwarebytes' Anti-Malware 1.40
Database version: 2615
Windows 5.1.2600 Service Pack 3

8/13/2009 9:00:35 AM
mbam-log-2009-08-13 (09-00-35).txt

Scan type: Full Scan (C:\|)
Objects scanned: 308515
Time elapsed: 2 hour(s), 12 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 5
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 34

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword98 (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword98 (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttool (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Rosemary\msword98.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msword98.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{79ABA8B7-32FD-4FC8-B11A-E433612AB6BF}\RP846\A1504357.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{79ABA8B7-32FD-4FC8-B11A-E433612AB6BF}\RP846\A1502355.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{79ABA8B7-32FD-4FC8-B11A-E433612AB6BF}\RP846\A1502360.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{79ABA8B7-32FD-4FC8-B11A-E433612AB6BF}\RP846\A1502361.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{79ABA8B7-32FD-4FC8-B11A-E433612AB6BF}\RP846\A1503356.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{79ABA8B7-32FD-4FC8-B11A-E433612AB6BF}\RP846\A1503361.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{79ABA8B7-32FD-4FC8-B11A-E433612AB6BF}\RP846\A1503366.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{79ABA8B7-32FD-4FC8-B11A-E433612AB6BF}\RP846\A1504367.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{79ABA8B7-32FD-4FC8-B11A-E433612AB6BF}\RP846\A1504368.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\WINDOWS\cru629.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cru629.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\figaro.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\beep.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\braviax.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\beep.sys (Fake.Beep.sys) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BNDD.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BN3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BN6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BN7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temp\BN9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\wpv191250008288.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\wpv511250024935.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Rosemary\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.
C:\WINDOWS\braviax.exe (Trojan.Downloader) -> Quarantined and deleted successfully.