TechSpot

[Sality- Not curable]How do i remove XxX.xX.x, UuU.uUu, winiudle and winqbode  files?

By buggy2121
Nov 16, 2010
Topic Status:
Not open for further replies.
  1. my computer keeps popping up errors like XxX.xXx file is corrupt and UuU.uUu file is corrupt. i went to the temp folders and saw these files and also a winiudle and winqbode file and tried deleting them but they just came back
    so i checked them out on the net and it said that this was a malware
    so i went to the malware removal guide:
    http://www.techspot.com/vb/topic58138.html
    and downloaded avira and performed a scan and it detected 115 malwares. i checked the quarantine section and alot of the files contain a "code of the W32/Satility.AT windows virus" and some contain a TR/Dropper.Gen Trojan and a TR/Downloader.Gen Trojan
    i followed all the steps except step 3 because MBAM is not working on my computer for some reason. it gets downloaded and opens but when i click quick scan and scan it, it just freezes
    P.S my task manager is also not opening and there is a image file called Win_Xp in my start menu which the computer is saying is corrupt but i cannot delete it.
    the guide said to post the gmer and dds file so here they are:

    GMER log:

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2010-11-16 14:28:09
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e ST3120213AS rev.3.AAH
    Running: kfpuh3y5.exe; Driver: C:\DOCUME~1\Farukh\LOCALS~1\Temp\kfxyipob.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

    ---- Processes - GMER 1.0.15 ----

    Process C:\DOCUMENTS AND SETTINGS\ALL USERS\START MENU\WIN_XP.EXE (*** hidden *** ) 852

    ---- EOF - GMER 1.0.15 ----

    DDS.txt:

    DDS (Ver_10-11-10.01) - FAT32x86
    Run by Farukh at 14:28:34.12 on 16-11-2010
    Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_14
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.526 [GMT 5:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    SVCHOST.EXE
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    SVCHOST.EXE
    SVCHOST.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    SVCHOST.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\explorer.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Documents and Settings\All Users\Start Menu\Win_Xp.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Documents and Settings\All Users\Start Menu\Win_Xp.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    F:\My Stuff\iPod\iTunesHelper.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    F:\Program Files\ClickToConvert\C2CMonitor.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Documents and Settings\Farukh\Desktop\dds.scr
    C:\WINDOWS\system32\dwwin.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com.pk/
    uSearch Page = hxxp://www.qword.com/?s=1
    uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
    mStart Page = hxxp://eis.esnips.com/page/search/?client_uuid=bda82ac0-85c3-4b48-b0d2-41fde8d1391d
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    uURLSearchHooks: iWin Toolbar: {ce0c2586-da36-452b-acdb-320d9bcb19bf} -
    uURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
    mWinlogon: Shell=explorer.exe, scvhost.exe
    mWinlogon: Userinit=c:\windows\system32\Userinit.exe,scvhost.exe
    mWinlogon: Taskman=c:\recycler\s-1-5-21-2798399367-7949084698-176230238-4038\sysdate.exe
    BHO: MyWebSearch Search Assistant BHO: {00a6faf1-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
    {0343958c-da34-40c9-b20b-09a353b2da70}
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: mwsBar BHO: {07b18ea1-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: E-Zsoft VideoDownloaderToolBar: {4322a444-92f8-4c3e-bd4c-013ba51e2871} - c:\program files\nbget\internetdownload\VDTB.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    BHO: eSnipsBHO Class: {b530a9a4-1722-4d16-aad6-aa85e3ad2ade} - c:\program files\logia\esnipsdownloader\eSnipsBHO.dll
    BHO: {ce0c2586-da36-452b-acdb-320d9bcb19bf} - iWin Toolbar
    BHO: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: iWin Toolbar: {ce0c2586-da36-452b-acdb-320d9bcb19bf} -
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    TB: E-Zsoft VideoDownloaderToolBar: {4322a444-92f8-4c3e-bd4c-013ba51e2871} - c:\program files\nbget\internetdownload\VDTB.dll
    TB: My Web Search: {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL
    TB: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [Google Update] "c:\documents and settings\farukh\local settings\application data\google\update\GoogleUpdate.exe" /c
    uRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe
    uRun: [uTorrent] "f:\program files\uTorrent.exe"
    uRun: [BitTorrent] "f:\program files\BitTorrent.exe"
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    mRun: [DU Meter] c:\program files\du meter\DUMeter.exe
    mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"
    mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe
    mRun: [HP Software Update] "c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe"
    mRun: [Updater] c:\windows\system32\updater\explorer.exe
    mRun: [RTHDCPL] RTHDCPL.EXE
    mRun: [Alcmtr] ALCMTR.EXE
    mRun: [Media Codec Update Service] c:\program files\essentials codec pack\update.exe -silent
    mRun: [Adobe Reader Speed Launcher] "f:\my stuff\adobe\reader\Reader_sl.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
    mRun: [InternetDownload_upgrade] "c:\program files\nbget\internetdownload\InternetDownload.exe" /upgrade
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [My Web Search Bar Search Scope Monitor] "c:\progra~1\mywebs~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h
    mRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe
    mRun: [eSnips_Downloader] "c:\program files\logia\esnipsdownloader\eSnips_Downloader.exe" -startup
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "f:\my stuff\ipod\iTunesHelper.exe"
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - f:\program files\office xp\office10\OSA.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\c2cmon~1.lnk - f:\program files\clicktoconvert\C2CMonitor.exe
    uPolicies-system: DisableRegedit = 0 (0x0)
    uPolicies-system: DisableTaskMgr = 1 (0x1)
    uPolicies-system: DisableRegistryTools = 1 (0x1)
    mPolicies-system: EnableLUA = 0 (0x0)
    IE: &Search - http://edits.mywebsearch.com/toolba...000&si=&a=7KxtcB9HfqWt8PiECQEYbA&n=2010032912
    IE: Download by NBget Internet Download - c:\program files\nbget\internetdownload\adddownload.htm
    IE: E&xport to Microsoft Excel - f:\progra~1\office~1\office10\EXCEL.EXE/3000
    IE: Free YouTube to Mp3 Converter - c:\documents and settings\farukh\application data\dvdvideosoftiehelpers\youtubetomp3.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    Trusted Zone: qword.com
    DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
    DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1195826417793
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://www.arcadetown.com/swf/popcap/popcaploader_v6.cab
    TCP: {CFB2024C-3425-4B7E-8B21-1D691F0FA349} = 203.81.204.23,203.81.204.3
    Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Notify: avgrsstarter - avgrsstx.dll
    Notify: igfxcui - igfxsrvc.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    LSA: Authentication Packages = msv1_0 nwprovau
    mASetup: {218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML} - c:\documents and settings\all users\start menu\Win_Xp.exe

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\farukh\applic~1\mozilla\firefox\profiles\ld2ed8sf.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.pk/
    FF - prefs.js: keyword.URL - hxxp://eis.esnips.com/page/search_provider/?client_uuid=bda82ac0-85c3-4b48-b0d2-41fde8d1391d&q=
    FF - plugin: c:\documents and settings\farukh\application data\facebook\npfbplugin_1_0_1.dll
    FF - plugin: c:\documents and settings\farukh\application data\facebook\npfbplugin_1_0_3.dll
    FF - plugin: c:\documents and settings\farukh\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\documents and settings\farukh\local settings\application data\unity\webplayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\mywebsearch\bar\1.bin\NPMYWEBS.DLL
    FF - plugin: c:\program files\view22\version_4\NPView22.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: f:\my stuff\adobe\reader\browser\nppdf32.dll
    FF - plugin: f:\my stuff\divx\divx content uploader\npUpload.dll
    FF - plugin: f:\my stuff\divx\divx player\npDivxPlayerPlugin.dll
    FF - plugin: f:\my stuff\divx\divx web player\npdivx32.dll
    FF - plugin: f:\my stuff\ipod\mozilla plugins\npitunes.dll
    FF - plugin: f:\my stuff\real\netscape6\nppl3260.dll
    FF - plugin: f:\my stuff\real\netscape6\nprjplug.dll
    FF - plugin: f:\my stuff\real\netscape6\nprpjplug.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

    ============= SERVICES / DRIVERS ===============

    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-11-14 11608]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-11-4 335240]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-11-4 27784]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-11-4 108552]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-11-14 135336]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-14 267944]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-11-4 297752]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-14 60936]
    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-2-25 54752]
    R3 USRWDXJS;USRWDXJSMiniPCI Winmodem;c:\windows\system32\drivers\USRWDXJS.sys [2007-11-23 687999]
    S2 MyWebSearchService;My Web Search Service;c:\progra~1\mywebs~1\bar\1.bin\mwssvc.exe [2010-3-29 28762]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
    S3 V0100VID;Creative WebCam Vista Pro;c:\windows\system32\drivers\V0100Vid.sys [2007-11-24 91155]

    =============== Created Last 30 ================


    ==================== Find3M ====================

    2010-11-15 11:44:50 103140 --sh--r- C:\hytn.pif
    2010-11-14 09:06:40 103140 --sh--r- C:\bivoti.pif
    2010-10-01 08:41:08 816 ----a-w- c:\windows\system32\ker.dll
    2010-09-18 07:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53:26 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53:26 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53:26 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-09 13:38:02 832512 ----a-w- c:\windows\system32\wininet.dll
    2010-09-09 13:38:02 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
    2010-09-09 13:38:00 78336 ----a-w- c:\windows\system32\ieencode.dll
    2010-09-09 13:38:00 17408 ------w- c:\windows\system32\corpol.dll
    2010-09-08 15:57:58 389120 ----a-w- c:\windows\system32\html.iec
    2010-09-08 06:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-09-08 06:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-09-01 11:51:14 285824 ----a-w- c:\windows\system32\atmfd.dll
    2010-08-31 13:42:52 1852800 ----a-w- c:\windows\system32\win32k.sys
    2010-08-27 08:02:30 119808 ----a-w- c:\windows\system32\t2embed.dll
    2010-08-27 05:57:44 99840 ----a-w- c:\windows\system32\srvsvc.dll
    2010-08-26 12:52:46 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-08-23 16:12:04 617472 ----a-w- c:\windows\system32\comctl32.dll
    2006-06-01 16:49:58 374968 ---ha-w- c:\program files\common files\Codejock.PropertyGrid.v10.2.ocx

    ============= FINISH: 14:30:48.95 ===============

    and Attach.txt:

    DDS (Ver_10-11-10.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 23-11-2007 6:05:36 PM
    System Uptime: 16-11-2010 1:53:15 PM (1 hours ago)

    Motherboard: Intel Corporation | | D915GAV
    Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | J2E1 | 2799/133mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (FAT32) - 41 GiB total, 6.176 GiB free.
    D: is CDROM (CDFS)
    E: is FIXED (NTFS) - 33 GiB total, 23.32 GiB free.
    F: is FIXED (FAT32) - 18 GiB total, 16.545 GiB free.
    G: is FIXED (FAT32) - 20 GiB total, 8.651 GiB free.

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: 3Com EtherLink XL 10/100 PCI For Complete PC Management NIC (3C905C-TX)
    Device ID: PCI\VEN_10B7&DEV_9200&SUBSYS_100010B7&REV_74\4&23C0B1C&0&00F0
    Manufacturer: 3Com
    Name: 3Com EtherLink XL 10/100 PCI For Complete PC Management NIC (3C905C-TX)
    PNP Device ID: PCI\VEN_10B7&DEV_9200&SUBSYS_100010B7&REV_74\4&23C0B1C&0&00F0
    Service: EL90XBC

    ==== System Restore Points ===================

    No restore point in system.

    ==== Installed Programs ======================

    µTorrent
    AAC Decoder
    AC3Filter (remove only)
    Adobe Flash Player 10 ActiveX
    Adobe Reader 8.1.3
    Adobe Shockwave Player 11.5
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Ask Toolbar
    AutoUpdate
    AVG Free 8.5
    AVIcodec (remove only)
    Avira AntiVir Personal - Free Antivirus
    BitTorrent
    Bonjour
    Click to Convert 6.0
    Clue 1.0
    Compatibility Pack for the 2007 Office system
    Creative WebCam Center
    Creative WebCam Vista Pro Driver (1.00.05.0726)
    Critical Update for Windows Media Player 11 (KB959772)
    Cucusoft DVD to iPod + iPod Video Converter Suite 7.7.7.6
    Cucusoft MPEG to DVD Author 1.09
    Direct Show Ogg Vorbis Filter (remove only)
    DivX Codec
    DivX Converter
    DivX Player
    DivX Plus DirectShow Filters
    DivX Version Checker
    DivX Web Player
    Dr Robotniks Mean Bean Machine 1.0
    DU Meter
    eSnips Downloader
    Facebook Plug-In
    ffdshow (remove only)
    Free Audio CD Burner version 1.4
    Free YouTube to MP3 Converter version 3.9
    Google Chrome
    GPL MPEG-1/2 DirectShow Decoder Filter
    H.264 Decoder
    Haunting The 1.0
    High Definition Audio Driver Package - KB888111
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Format SDK (KB902344)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB954708)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    HP Deskjet 3740
    HP Drive Key Boot Utility
    HP Software Update
    Intel A/V Codecs V2.0
    Intel(R) Graphics Media Accelerator Driver
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 14
    Java(TM) 6 Update 3
    Jesterware DVD Rip to iPod
    Jungle Book The 1.0
    Junk Mail filter update
    K-Lite Mega Codec Pack 1.38
    LEAD MCMP_MJPEG Codec Eval
    Malwarebytes' Anti-Malware
    Mega Bomberman 1.0
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Live Add-in 1.3
    Microsoft Office XP Professional with FrontPage
    Microsoft Reader
    Microsoft Search Enhancement Pack
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Windows Journal Viewer
    MKV Splitter
    Monopoly 1.0
    Mozilla Firefox (3.6.10)
    Mpeg Layer3 Codec FHG-Radium v1.263
    mpegable DS decoder
    MSN
    MSVCRT
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6 Service Pack 2 (KB954459)
    My Web Search (IWON)
    OGA Notifier 2.0.0048.0
    PowerQuest PartitionMagic Pro 7.0
    QuickTime
    RealPlayer
    Realtek High Definition Audio Driver
    RealUpgrade 1.0
    Rolo to the Rescue
    Scientific-Atlanta WebSTAR 2000 series Cable Modem
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Windows Internet Explorer 7 (KB2183461)
    Security Update for Windows Internet Explorer 7 (KB2360131)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 7 (KB972260)
    Security Update for Windows Internet Explorer 7 (KB974455)
    Security Update for Windows Internet Explorer 7 (KB976325)
    Security Update for Windows Internet Explorer 7 (KB978207)
    Security Update for Windows Internet Explorer 7 (KB982381)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB936782)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981349)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    Segoe UI
    Shutter Island 1.00
    Spelling Dictionaries Support For Adobe Reader 8
    Star Trek TNG Game
    Tarzan Action Game
    Tiny Toon Adventures - Buster's Hidden Treasure
    Toejamand Earlin Panicon Funkotron 1.0
    TouchCopy 09
    Triazzle
    Uniblue RegistryBooster 2009
    Uninstall 1.0.0.1
    Unity Web Player
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 7 (KB976749)
    Update for Windows Internet Explorer 7 (KB980182)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    VC80CRTRedist - 8.0.50727.762
    VobSub v2.23 (Remove Only)
    WebFldrs XP
    Windows Essentials Media Codec Pack 1.0
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Internet Explorer 7
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live Mail
    Windows Live Messenger
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Toolbar
    Windows Live Upload Tool
    Windows Live Writer
    Windows Media Format 11 runtime
    Windows Media Format SDK Hotfix - KB891122
    Windows Media Player 11
    Windows XP Service Pack 3
    WinFF 0.33
    WinZip
    Xilisoft iPod Rip
    XMLinst
    XviD MPEG-4 Codec

    ==== Event Viewer Messages From Past Week ========

    14-11-2010 11:33:19 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.MFC. Reference error message: The referenced assembly is not installed on your system. .
    14-11-2010 11:33:19 PM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\Farukh\LOCALS~1\Temp\RarSFX0\redist.dll. Reference error message: The operation completed successfully. .
    14-11-2010 11:33:19 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.MFC could not be found and Last Error was The referenced assembly is not installed on your system.
    14-11-2010 10:24:51 PM, error: Service Control Manager [7000] - The amsint32 service failed to start due to the following error: Access is denied.
    13-11-2010 1:18:15 PM, error: Dhcp [1002] - The IP address lease 192.168.100.10 for the Network Card with network address 001868E14C6F has been denied by the DHCP server 203.81.204.29 (The DHCP Server sent a DHCPNACK message).

    ==== End Of File ===========================
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Welcome to TechSpot but not good news- Read about the Sality virus infection: This is the malware that exploits the .lnk vulnerability.

    Sality is a family of file infecting viruses that spread by infecting exe and scr files. The virus also includes an autorun worm component that allows it to spread to any removable or discoverable drive. In addition, Sality includes a downloader trojan component that installs additional malware via the Web

    It then creates and starts a service to load the driver. The driver blocks access to a variety of security software vendor web sites.The virus then disables security software services and ends security software processes. It also disables registry editing and the task manager.

    http://www.symantec.com/connect/blogs/all-one-malware-overview-sality

    Let's try and confirm. Run the following first and then follow with Mbam. Hopefully that will allow the scan:
    Please download randmbam.exe

    It will try to create random names and shortcuts for Malwarebytes Anti Malware(MBAM) if you have it installed already.

    Once done, try running a scan again

    Then run this online virus scan:

    Run Eset NOD32 Online AntiVirus scan HERE
    1. Tick the box next to YES, I accept the Terms of Use.
    2. Click Start
    3. When asked, allow the Active X control to install
    4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    5. Click Start
    6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    7. Click Scan
    8. Wait for the scan to finish
    9. Re-enable your Antivirus software.
    10. A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

    I will know better what to recommend after seeing these logs.

    In the meantime, Please do not use any other cleaning programs or scans while I'm helping you, unless I direct you to. Do not use a Registry cleaner or make any changes in the Registry.
  3. buggy2121

    buggy2121 Newcomer, in training Topic Starter

    when you said that it gets into any removable drive does that mean it got into my ipod and printer? because they were connected to my computer when i didn't know about the malware

    here is the Mbam log:

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 5128

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 7.0.5730.13

    16-11-2010 11:14:36 PM
    mbam-log-2010-11-16 (23-14-36).txt

    Scan type: Quick scan
    Objects scanned: 148625
    Time elapsed: 13 minute(s), 45 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 163
    Registry Values Infected: 12
    Registry Data Items Infected: 7
    Folders Infected: 14
    Files Infected: 119

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{218a3q1v-m05n-o32l-4am8-ma0jeimdl4ml} (Generic.Bot.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.datacontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b813095c-81c0-4e40-aa14-67520372b987} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{cff4ce82-3aa2-451f-9b77-7165605fb835} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{8e6f1832-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a9571378-68a1-443d-b082-284f960c6d17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.outlookaddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{938aa51a-996c-4884-98ce-80dd16a5c9da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{bf0a1ff4-bbaf-487f-bc85-a24ef8f443a8} (Adware.Comet) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{d9fffb27-d62a-4d64-8cec-1ff006528805} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{218a3q1v-m05n-o32l-4am8-ma0jeimdl4ml} (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{9d71d88c-c598-4935-c5d1-43aa4db90836} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{819ffe20-35c7-4925-8cda-4e0e2db94302} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{819ffe21-35c7-4925-8cda-4e0e2db94302} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{819ffe22-35c7-4925-8cda-4e0e2db94302} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{799391d3-eb86-4bac-9bd3-cbfea58a0e15} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{d858dafc-9573-4811-b323-7011a3aa7e61} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{67fa02c4-ab30-4e77-a640-78ee8ec8673b} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.multiplebutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.multiplebutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.urlalertbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.urlalertbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\bifrost (Bifrose.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\qword.com (Adware.QWO) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Mirar (Adware.Mirar) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PLayMP3z) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\bifrost (Bifrose.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 (Virus.Sality) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyWebSearchService (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\my web search bar search scope monitor (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch email plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch email plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\www.qword.com (Adware.QWO) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\disableregedit (Hijack.Regedit) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3popularscreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\funwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\updater (Backdoor.Bot) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\search page (Hijack.Homepage) -> Bad: (http://www.qword.com/?s=1) Good: (http://www.Google.com/) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe, scvhost.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\WINDOWS\system32\LocalService (Trojan.Tracur) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar\1.bin\chrome (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Avatar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Message (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\icons (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\setups (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Files Infected:
    C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\bivoti.pif (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\hytn.pif (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\f3PSSavr.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\LocalService\321.crack.zip.kwd (Trojan.Tracur) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\LocalService\322.keygen.zip.kwd (Trojan.Tracur) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\LocalService\323.serial.zip.kwd (Trojan.Tracur) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\LocalService\324.setup.zip.kwd (Trojan.Tracur) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\LocalService\325.music.au.kwd (Trojan.Tracur) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\LocalService\326.music2.au.kwd (Trojan.Tracur) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\LocalService\327.music3.au.kwd (Trojan.Tracur) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\LocalService\328.music4.au.kwd (Trojan.Tracur) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\CHROME.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3REGHK.DLL (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\INSTALL.RDF (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3AUXSTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3DLGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar\1.bin\MWSMLBTN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> Delete on reboot.
    C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\MWSUABTN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\M3PATCH.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00052060 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00054899.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\000574F9.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00057E40.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\0005896B.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00058E6C.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\0044EDFF.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\0044F6B9.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\0044FD12.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\004507A1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00055AD9 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00032A2E.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00032F6E.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\0003371E.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00033B54.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00033EFE.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\0003422A (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00037B6B (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\003964BF.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00397FF8.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\00399DF0.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\0039B9C5.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\000457D1.bmp (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\Cache\009152A3.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Farukh\Application Data\0200000099fa339b691C.manifest (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Farukh\Application Data\0200000099fa339b691O.manifest (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Farukh\Application Data\0200000099fa339b691S.manifest (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Farukh\Application Data\0200000099fa339b691P.manifest (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Farukh\Application Data\addons.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Farukh\Application Data\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\GroupPolicy000.dat (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Farukh\Local Settings\Temp\MSN.abc (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Farukh\Local Settings\Temp\UuU.uUu (Malware.Trace) -> Delete on reboot.
    C:\Documents and Settings\Farukh\Local Settings\Temp\XxX.xXx (Malware.Trace) -> Delete on reboot.
    C:\Documents and Settings\Farukh\Local Settings\Temp\xxxyyyzzz.dat (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\GnuHashes.ini (Malware.Trace) -> Quarantined and deleted successfully.
  4. buggy2121

    buggy2121 Newcomer, in training Topic Starter

    and here is the ESET log:

    ESETSmartInstaller@High as CAB hook log:
    OnlineScanner.ocx - registred OK
    # version=7
    # IEXPLORE.EXE=7.00.6000.17091 (vista_gdr.100824-1500)
    # OnlineScanner.ocx=1.0.0.6211
    # api_version=3.0.2
    # EOSSerial=16498005a9243347bc5979e48745b864
    # end=finished
    # remove_checked=false
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=false
    # antistealth_checked=true
    # utc_time=2010-11-16 07:50:08
    # local_time=2010-11-17 12:50:08 (+0500, Pakistan Standard Time)
    # country="United States"
    # lang=9
    # osver=5.1.2600 NT Service Pack 3
    # compatibility_mode=1024 16777179 100 0 32607664 32607664 0 0
    # compatibility_mode=1797 16775145 100 93 172622 26476792 154530 0
    # compatibility_mode=8192 67108863 100 0 824 824 0 0
    # scanned=51125
    # found=168
    # cleaned=0
    # scan_time=3982
    C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}\registrybooster2\7CE1607E\6383BC9B\RegistryBooster.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Documents and Settings\Farukh\Local Settings\Temp\yviq.exe probably a variant of Win32/Agent.HLU trojan 00000000000000000000000000000000 I
    C:\Documents and Settings\Farukh\Local Settings\Temp\buxjxu.exe a variant of Win32/PSW.Agent.NPT trojan 00000000000000000000000000000000 I
    C:\Documents and Settings\Farukh\Desktop\kfpuh3y5.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Documents and Settings\Farukh\Desktop\mbam-setup-1.46(2).exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Documents and Settings\Farukh\Application Data\Sun\Java\JRERunOnce.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Common Files\Nero\Uninstall\Setupx.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_03.b05\patchjre.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Common Files\DVDVideoSoft\FreeStudioManager.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Common Files\DVDVideoSoft\unins000.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Common Files\DVDVideoSoft\TB\DVDVideoSoftTB.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\MSN\MSNCoreFiles\Install\msnsusii.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\AVG\spiceal.bat BAT/KillAV.NBD trojan 00000000000000000000000000000000 I
    C:\Program Files\AVG\AVG8\avgui.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\AVG\AVG8\avgfrw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig708\ENU_\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Adobe\Adobe Help Viewer\1.0\ahv.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\AVIcodec\avicodec.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\QuickTime\Quick Time\QuickTimeInstaller.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\QuickTime\Quick Time\QuickTimePlayer.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Windows Live\Messenger\riched20.dll Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
    C:\Program Files\Windows Live\Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
    C:\Program Files\Shockwave.com\Dream Chronicles 2 - The Eternal Maze\dream2.exe probably a variant of Win32/Agent.MOKPFWD trojan 00000000000000000000000000000000 I
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Program Files\Malwarebytes' Anti-Malware\968224518968.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    C:\Recycled\Dc22.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    E:\dap85.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    E:\fuqqla.pif Win32/Sality.NBA virus 00000000000000000000000000000000 I
    E:\lusetup-lt.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    E:\Du Meter 3.07 Build 200 crack\du.meter.3.07.build.200.keygen-tsrh.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\xqibed.pif Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\Program Files\Windows Media Player\migrate.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\Program Files\Office Xp\Office10\GRAPH.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\Program Files\Office Xp\Office10\FRONTPG.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\Program Files\Office Xp\Office10\MSACCESS.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\Program Files\Office Xp\Office10\POWERPNT.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\Program Files\Office Xp\Office10\WINWORD.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\Program Files\Office Xp\Office10\EXCEL.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\mpegableDSdecoder-Setup.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\iPodConvSuit.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\sylvester1.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\EasyRMtoMP3Converter.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Shockwave_Installer_Full.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Shockwave_Installer_Slim.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\dvd-author.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\LimeWireWin(2).exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Firefox Setup 3.6.3.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Silverlight.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\LimeWireWin.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\x-ipod-rip.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\vlc-1.1.4-win32.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\FreeYouTubeToMp3Converter.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Winzip\winzip90.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Winzip\WINZIP32.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\WinRAR\wrar36b2.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\WebCam\WCC_PCApp_US_1_71_02.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\WebCam\WCVP_PCDRV_US_1_00_05_0726.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Repligo\RepliGo Viewer\RepliGoView.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\MSREADER\MSReaderSetupUSA.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Mozilla\firefox.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\iPod\dvdriptoipod.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\iPod\jesterwaredvdriptoipod.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\iPod\MP4-converter\ipod-converter\MP4Converter.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\iPod\MP4-converter\ipod-converter\DVD2X.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\iPod\WinFF\ffmpeg.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\iPod\WinFF\ffplay.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Adobe\psa30se_en_us.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\DivX\DivXInstaller.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\DivX\DivX Player\DivX Player.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Real\Setup\setup.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Essentials Codec Pack\mplayerc.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\LEAD Technologies, Inc\LEAD Converter\convert.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\K-Lite Codec Pack\Media Player Classic\mplayerc.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\ffdshow\uninstall.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\AC3Filter\dialog_patch.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Movie Maker\moviemk.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\QuickTime\QuickTimePlayer.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\ClickToConvert\clicktoconvert.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\iPod Manager\ipodmanager.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    F:\My Stuff\Free YouTube to MP3 Converter\unins000.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\20071122-022-i32.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\GenuineCheck.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\tnkni.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\20071201-002-i32.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Du Meter 3.07 Build 200 crack\du.meter.3.07.build.200.keygen-tsrh.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\CentralQ\QConsole\instmsia.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\CentralQ\QConsole\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\CentralQ\QServer\instmsia.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\CentralQ\QServer\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Installations\av_en220.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Installations\gw107_en.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Installations\lusetup-lt.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Installations\md710_en.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Installations\rf_en.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Installations\wa300_en.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Installations\Cracks\keygenRF501.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Installations\Zone_Alarm\zaAvSetup_50_590_015.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Rollout\AVServer\SETUP.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Rollout\AVServer\AMS2\WINNT\instmsia.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Rollout\AVServer\AMS2\WINNT\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Rollout\AVServer\CLIENTS\WIN32\instmsia.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Rollout\AVServer\CLIENTS\WIN32\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Rollout\AVServer\SERVER\WINNT\instmsia.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Rollout\AVServer\SERVER\WINNT\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\SAV\instmsia.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\SAV\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\SSC\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\SSC\MMC\IMMC.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\SymSentry\Symantec VPN Sentry\Setup.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\SymSentry\Symantec VPN Sentry for Check Point\Setup.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\SymSentry\Symantec VPN Sentry for Nortel Networks\Setup.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Tools\LiveUpdate\LUAU.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Tools\LiveUpdate\LUSETUP.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Tools\Nosuprt\Packager\instmsia.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\Tools\Nosuprt\Packager\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\WIN32\instmsia.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\SYMANTEC 9\WIN32\instmsiw.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Unzipped\CLIENTS[1]\CLIENTS\INSTMSIA.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Unzipped\CLIENTS[1]\CLIENTS\INSTMSIW.EXE Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Tiny Toon Adventures - Buster's Hidden Treasure\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Toejamand Earlin Panicon Funkotron\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Clue\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Mega Bomberman\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Mega Bomberman\MegaBomberman.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Jungle Book The\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\sylvester_and_tweety_in_cagey_capers.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\ToejamandEarl.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Toy Story\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Toy Story\toy_story.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Toejamand Earlin Panicon Funkotron\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Toejamand Earlin Panicon Funkotron\ToejamandEarlinPaniconFunkotron.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Tiny Toon Adventures - Buster's Hidden Treasure\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Mickey Mouse Worldof Illusion\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Mickey Mouse Worldof Illusion\MickeyMouseWorldofIllusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Mega Bomberman\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Mega Bomberman\MegaBomberman.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Lion King The\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Lion King The\LionKingThe.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Jurassic Park 2 - The Lost World\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Jurassic Park 2 - The Lost World\jurassic_park_2_the_lost_world.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Jungle Book The\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Jungle Book The\JungleBookThe.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Flintstones\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Earthworm Jim\earthworm_jim.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Earthworm Jim\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Aladdin\Aladdin.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Aladdin\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\rolo\Sega\Rolo to the Rescue\Fusion.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\DivX\AVIcodec\avicodec.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\NetMeeting\cb32.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\NetMeeting\conf.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\Partition Magic Pro 7.0.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\avg75free_516a1262.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\dap87.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\dap92_bros.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\Winzip12\winzip120.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\UniBlue RegistryBooster\cbspeedbitregistrybooster.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\HARDDISK UTILITY\DriverUpdaterPro.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\HARDDISK UTILITY\freeundelete.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\HARDDISK UTILITY\RecoverMyFiles-Setup.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\HARDDISK UTILITY\undelete_plus_setup.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\HARDDISK UTILITY\DRWSetup.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\HARDDISK UTILITY\EPRDemoSetup.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    G:\Ayaz04112009\HARDDISK UTILITY\Partition Magic Pro 7.0.exe Win32/Sality.NBA virus 00000000000000000000000000000000 I
    ${Memory} multiple threats 00000000000000000000000000000000 I
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Drives C,E,F and G are badly infected with the Sality virus. One of the causes is that not only are you running 2 antivirus rograms which makes a system more vulnerable, but both of them are outdated. Essentially this means you have no AV protection.

    There is no way this system can be cleaned.

    Additional information about Sality:
    Windows fails to correctly parse shortcut files, identified by the ".lnk" extension. The flaw has been exploited most frequently using USB flash drives. By crafting a malicious .lnk file, hackers can hijack a Windows PC with little user interaction: All that's necessary is that the user views the contents of the USB drive with a file manager like Windows Explorer.

    Tests showed that the exploit works even when AutoRun and AutoPlay -- two functions that have previously been used by attackers to commandeer PCs using infected flash drives -- are disabled. The rootkit also bypasses all security mechanisms in Windows, including the User Account Control (UAC) prompts in Vista and Windows 7, ...
    Worm is named Win32/Stuxnet.A.

    Because of these actions, We recommend you do a reformat/reinstall. Attempts to clean this virus to include the backdoor capability usually fail.

    You will find excellent reformat/reinstall instructions here:
    http://www.tech-101.com/tutorials/356-tutorial-windows-install-repair-xp-vista.html
  6. buggy2121

    buggy2121 Newcomer, in training Topic Starter

    i downloaded avira because avg was not opening
    thank you for your help i'll try reformating/reinstalling
  7. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    You're welcome. You need to beef up the security on your system, run regular maintenance and do frequent malware scans.The malware was probably stopping the AV from running.

    You need to change all of your password now and then again after you reformat/reinstall. Monitor all online financial transactions.

    Print out the following to use when the computer is clean:
    Tips for added security and safer browsing:
    1. Browser Security Settings: Custom is fine if the user did the settings. Mine are Custom. Default is okay too, but sometimes too restrictive.
      This Tutorial will help guide you through Configuring Security Settings, Managing Active X Controls and other safety features: Make Internet Explorer safer.
    2. Have layered Security:
      • Antivirus Software(only one):Both of the following programs are free and known to be good:
        [o]Avira Free
        [o]Avast Home
      • Firewall (only one): Use bi-directional firewall. Both of the following programs are free and known to be good:
        [o]Comodo
        [o]Zone Alarm
      • Antispyware: I recommend all of the following:
        [o]Spywareblaster: SpywareBlaster protects against bad ActiveX. It places kill bits to stop bad Active X controls from being installed. Remember to update it regularly.
      [o]Download ZonedOut and save to your desktop. this replaces IE/Spyad and manages the Zones in Internet explorer. This places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
      For IE7 and IE8, Windows 2000 thru Vista. No Windows 7 yet.
      IE/Spyad is not longer being supported. If you have this on your system, you should replace it with the following program. Make sure your IE8 is Up-to-date before adding sites to your restricted zone.
      Known issue: If you have "immunized" your computer with Spybot Search and Destroy, and use ZonedOut to "Remove All" restricted sites - ZonedOut will remove your trusted sites as well. Note that if you remove Spybot Search and Destroys Immunization the problem goes away...
      [o]MVPS Hosts files This replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
      [o]Google Toolbar Get the free google toolbar to help stop pop up windows.
    3. Stay current on updates:
      [o] Visit the Microsoft Download Sitefrequently. You should get All updates marked Critical and the current SP updates.
      [o]Visit this Adobe Reader site often and make sure you have the most current update. Uninstall any earlier updates as they are vulnerabilities.
      [o]Check this site .Java Updates Stay current as most updates are for security. Uninstall any earlier versions in Add/Remove Programs.
    4. Reset Cookies to prevent Tracking Cookies:
      [o]For Internet Explorer: Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> check 'override automatic Cookie handling'> check 'accept first party Cookies'> check 'Block third party Cookies'> check 'allow per session Cookies'> Apply> OK.
      [o]For Firefox: Tools> Options> Privacy> Cookies> check ‘accept Cookies from Sites’> Uncheck 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others. (Note: for Firefox v3.5, after Privacy click on 'use custom settings for History.')
      I suggest using the following two add-on for Firefox. They will prevent the Tracking Cookies that come from ads and banners and other sources:
      AdBlock Plus
      Easy List
    5. Do regular Maintenance
      Remove Temporary Internet Files regularly:
      [o]ATF Cleaner by Atribune
      OR
      [o]TFC
      Disable and Enable System Restore:
      [o]See System Restore Guide This will help you understand what this is, why you need to clean and set restore points and what information is in them.
    6. Practice Safe Email Handling
      [o] Don't open email from anyone you don't know.
      [o] Don't open Attachments in the email. Safe to your desktop and scan for viruses using a right click
      [o] Don't leave your personal email address on the internet. Have a separate email account at one of the free web-based emails like Yahoo.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.