Member Avatar for ManojNJ
ManojNJ 0 Newbie Poster

Hi,

I had faced the problem of MGMRWMRV.exe in my PC and have used the tips provided by using mbam and then combofix. Initially I had traced the infections through several spyware detectors PC Doctor, zoneAlarm etc. But those were not able to remove them. I just came across this thread and tried MBAM and Combofix. I have attached the logs after running each of them.
When i run PC doctor, i still see a few infections which I am not able to remove. Please advice on How can I remove the rest of the Infections and What are the steps should I follow in future to keep malwares away.

<a href="/images/attachments/1/mbam-log-3-9-2008%20(21-33-50)_complete.txt">mbam-log-3-9-2008 (21-33-50)_complete.txt</a>

<a href="/images/attachments/1/ComboFix.txt">ComboFix.txt</a>

<img src="/images/attachments/1/Infections.bmp" title="" alt="Infections.bmp" />

Thanks
M

ComboFix 08-03-09.1 - ctrq154 2008-03-10  1:08:32.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.107 [GMT -5:00]
Running from: C:\Documents and Settings\ctrq154\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\.protected
C:\Documents and Settings\All Users\Application Data.\vedcbeze.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\.protected
C:\Documents and Settings\ctrq154\Application Data\ECURIT~1
C:\Documents and Settings\ctrq154\Application Data\ECURIT~1\n?tepad.exe
C:\Documents and Settings\ctrq154\Start Menu\Programs\Startup\.protected
C:\Program Files\Common Files\tsks~1
C:\Program Files\Common Files\tsks~1\arpa.exe
C:\Program Files\Common Files\tsks~1\T?sks\
C:\WINDOWS\.protected
C:\WINDOWS\kvihapwl.dll
C:\WINDOWS\PerfInfo
C:\WINDOWS\PerfInfo\rY0aoDedBUwp.exe
C:\WINDOWS\system32\222FFB48D1.dll
C:\WINDOWS\system32\drivers\etc\.protected

----- BITS: Possible infected sites -----

hxxp://10.80.161.18
.
(((((((((((((((((((((((((   Files Created from 2008-02-10 to 2008-03-10  )))))))))))))))))))))))))))))))
.

2008-03-09 19:44 . 2008-03-09 19:44	<DIR>	d--------	C:\Documents and Settings\ctrq154\Application Data\Malwarebytes
2008-03-09 19:43 . 2008-03-09 19:43	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-09 19:42 . 2008-03-09 19:45	<DIR>	d--------	C:\Program Files\Malwarebytes' Anti-Malware
2008-03-09 19:09 . 2008-03-09 21:37	<DIR>	d--------	C:\Program Files\180search assistant
2008-03-09 18:06 . 2008-03-09 18:06	<DIR>	d--------	C:\Program Files\Zone Labs
2008-03-09 18:05 . 2008-03-09 23:04	351,888	--a------	C:\WINDOWS\system32\vsconfig.xml
2008-03-09 18:04 . 2008-03-10 00:31	<DIR>	d--------	C:\WINDOWS\Internet Logs
2008-03-09 10:58 . 2008-03-09 23:24	<DIR>	d-a------	C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-09 10:58 . 2007-12-10 14:53	81,288	--a------	C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-09 10:58 . 2007-12-10 14:53	66,952	--a------	C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-09 10:58 . 2008-02-01 12:55	42,376	--a------	C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-09 10:58 . 2007-12-10 14:53	29,576	--a------	C:\WINDOWS\system32\drivers\kcom.sys
2008-03-09 10:56 . 2008-03-09 17:37	<DIR>	d--------	C:\Program Files\Spyware Doctor
2008-03-09 10:56 . 2008-03-09 10:56	<DIR>	d--------	C:\Documents and Settings\ctrq154\Application Data\PC Tools
2008-03-09 00:36 . 2008-03-09 00:36	<DIR>	d--------	C:\WINDOWS\FLEOK
2008-03-09 00:36 . 2008-03-09 00:36	<DIR>	d--------	C:\Program Files\stc
2008-03-09 00:36 . 2008-03-09 00:36	32,768	--a------	C:\WINDOWS\system32\shdocpe.dll
2008-03-09 00:36 . 2008-03-09 00:36	30,208	--a------	C:\WINDOWS\123messenger.per
2008-03-09 00:36 . 2008-03-09 00:36	27,392	--a------	C:\WINDOWS\msa64chk.dll
2008-03-09 00:36 . 2008-03-09 00:36	27,136	--a------	C:\WINDOWS\msapasrc.dll
2008-03-09 00:36 . 2008-03-09 00:36	26,880	--a------	C:\WINDOWS\system32\SIPSPI32.dll
2008-03-09 00:36 . 2008-03-09 00:36	9,216	--a------	C:\WINDOWS\system32\MSNSA32.dll
2008-03-09 00:35 . 2008-03-09 00:35	<DIR>	d--------	C:\Program Files\Sysmnt
2008-03-09 00:30 . 2008-03-09 00:30	9,662	--a------	C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-03-09 00:22 . 2008-03-09 21:33	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Rabio
2008-03-09 00:20 . 2008-03-09 00:20	<DIR>	d--------	C:\WINDOWS\knaolkdk
2008-03-09 00:20 . 2008-03-09 21:37	<DIR>	d--------	C:\Program Files\Bat
2008-03-09 00:20 . 2008-03-09 00:21	3,805,830	--a------	C:\WINDOWS\rY0aoDedBU.exe
2008-03-09 00:20 . 2008-03-09 00:20	189,440	--a------	C:\WINDOWS\zkritgrm.dll
2008-03-09 00:20 . 2008-03-09 00:20	88,593	--a------	C:\WINDOWS\ozajmxmr.exe
2008-03-09 00:19 . 2008-03-09 00:19	295,819	--a------	C:\WINDOWS\system32\LE490.tmp
2008-03-09 00:19 . 2008-03-09 00:19	229,532	--a------	C:\WINDOWS\system32\LCC6D.tmp
2008-03-09 00:19 . 2008-03-09 00:19	402	--a------	C:\WINDOWS\system32\L2EB.tmp
2008-03-02 19:50 . 2008-03-02 19:50	<DIR>	d--------	C:\Program Files\DivX
2008-03-02 18:37 . 2008-03-02 18:38	<DIR>	d--------	C:\Documents and Settings\ctrq154\Application Data\Yahoo!
2008-03-02 18:37 . 2008-03-02 18:37	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-25 20:17 . 2008-02-25 20:17	<DIR>	d--------	C:\Program Files\Common Files\xing shared
2008-02-22 12:33 . 2008-02-22 12:33	<DIR>	d--------	C:\Documents and Settings\ctrq154\Application Data\Helios
2008-02-20 21:05 . 2008-02-20 21:05	1,044,480	--a------	C:\WINDOWS\system32\libdivx.dll
2008-02-20 21:05 . 2008-02-20 21:05	200,704	--a------	C:\WINDOWS\system32\ssldivx.dll
2008-02-14 23:46 . 2008-02-25 20:17	<DIR>	d--------	C:\Program Files\Real
2008-02-14 23:46 . 2008-02-25 20:17	<DIR>	d--------	C:\Program Files\Common Files\Real
2008-02-14 23:43 . 2008-03-08 14:37	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Google Updater
2008-02-12 16:39 . 2008-02-12 16:39	6,029,648	--a------	C:\Firefox Setup 2.0.0.12.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-10 04:05	---------	d-----w	C:\Program Files\Symantec AntiVirus
2008-03-09 15:15	138	----a-w	C:\Program Files\uninstall.log
2008-03-09 05:36	27,392	----a-w	C:\WINDOWS\system32\ntnut32.exe
2008-03-02 17:53	---------	d-----w	C:\Program Files\Yahoo!
2008-03-02 17:53	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-15 04:43	---------	d-----w	C:\Program Files\Google
2008-02-08 03:44	---------	d-----w	C:\Program Files\EditPlus 2
2008-02-07 22:37	---------	d-----w	C:\Documents and Settings\ctrq154\Application Data\Subversion
2008-02-07 05:08	---------	d-----w	C:\Documents and Settings\ctrq156\Application Data\skypePM
2008-02-06 16:06	---------	d-----w	C:\Program Files\Java
2008-01-28 17:08	---------	d-----w	C:\Program Files\MSXML 4.0
2008-01-25 20:39	---------	d-----w	C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-25 17:01	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-01-18 21:23	---------	d-----w	C:\Program Files\decomp
2008-01-18 21:19	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Protexis
2008-01-18 21:18	---------	d-----w	C:\Program Files\Common Files\Wise Installation Wizard
2008-01-17 21:42	---------	d-----w	C:\Documents and Settings\ctrq156\Application Data\EditPlus 2
2008-01-16 20:34	---------	d-----w	C:\Program Files\Common Files\Mercury Interactive
2008-01-04 04:59	32	----a-w	C:\Documents and Settings\All Users\Application Data\ezsid.dat
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]
@={30351346-7B7D-4fcc-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]
@={30351347-7B7D-4fcc-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]
@={30351348-7B7D-4fcc-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]
@={3035134b-7B7D-4fcc-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]
@={3035134c-7B7D-4fcc-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]
@={3035134d-7B7D-4fcc-81B4-1E394CA267EB}

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]
@={3035134e-7B7D-4fcc-81B4-1E394CA267EB}

[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4fcc-81B4-1E394CA267EB}]
2005-07-15 13:10	434176	--a------	C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4fcc-81B4-1E394CA267EB}]
2005-07-15 13:10	434176	--a------	C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4fcc-81B4-1E394CA267EB}]
2005-07-15 13:10	434176	--a------	C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134b-7B7D-4fcc-81B4-1E394CA267EB}]
2005-07-15 13:10	434176	--a------	C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134c-7B7D-4fcc-81B4-1E394CA267EB}]
2005-07-15 13:10	434176	--a------	C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134d-7B7D-4fcc-81B4-1E394CA267EB}]
2005-07-15 13:10	434176	--a------	C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CLASSES_ROOT\CLSID\{3035134e-7B7D-4fcc-81B4-1E394CA267EB}]
2005-07-15 13:10	434176	--a------	C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-14 23:43 68856]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"Oota"="C:\PROGRA~1\COMMON~1\TSKS~1\arpa.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPKBDLED"="C:\WINDOWS\system32\TpScrLk.exe" [2002-10-08 22:28 40960]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2005-08-29 14:15 94208]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-25 21:00 344064]
"TP4EX"="tp4ex.exe" [2005-08-24 01:10 40960 C:\WINDOWS\system32\TP4EX.exe]
"BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2005-04-20 01:38 110592]
"BMMLREF"="C:\Program Files\ThinkPad\Utilitie
Infections.bmp (436.84 KB) 
Malwarebytes' Anti-Malware 1.08
Database version: 473

Scan type: Full Scan (C:\|)
Objects scanned: 244592
Time elapsed: 1 hour(s), 34 minute(s), 24 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 1
Registry Keys Infected: 33
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 21
Files Infected: 60

Memory Processes Infected:
c:\program files\xpdefender\xpdefender.exe (Rogue.XPDefender) -> Unloaded process successfully.
C:\WINDOWS\system32\mgmrwmrv.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:
C:\Program Files\Bat\Bat.dll (Adware.Batco) -> Unloaded module successfully.

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{71493218-e553-4fa8-85e2-e6d18fa75509} (Rogue.SpyMaxx) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{f4f41439-82fc-4681-acb0-7d3798f685c0} (Rogue.SpyMaxx) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mdreg.clsreg (Rogue.SpyMaxx) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e33f406-ab8f-4153-a5c8-089aeff5cc87} (Rogue.SpyMaxx) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15651c7c-e812-44a2-a9ac-b467a2233e7d} (Adware.123Mania) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{f663b917-591f-4172-8d87-3d7d729007ca} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bat.batbho (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{63f7460b-c831-4142-a4aa-5ec303ec4343} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{63f7460b-c831-4142-a4aa-5ec303ec4343} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bat.batbho.1 (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d279bc2b-a85b-4559-8fd9-ddc55f5d402d} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{b80a3586-caa5-41c8-89bf-e617f0b6cfbf} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5dafd089-24b1-4c5e-bd42-8ca72550717b} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8674aea0-9d3d-11d9-99dc-00600f9a01f1} (Fake.Dropped.Malware.Renos) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ism (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{548e1154-fa99-4b77-9fc5-02c9d8c9d24d} (Rogue.SpyAway) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\xpdefender (Rogue.XPDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{17996e72-ee06-4d59-943f-4c3ebba5a916} (Adware.AdBand) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8041e642-8cfc-4720-bc9d-d2db8904286f} (Adware.AdBand) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\QdrModule (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\QdrDrive (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\BATCO (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Batco (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\bat.DLL (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bat (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bat (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\xflock (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\PostInstallC (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\XPdefender (Rogue.XPDefender) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\XPdefender (Rogue.XPDefender) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\spyaway (Rogue.SpyAway) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPdefender (Rogue.XPDefender) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyAway (Rogue.SpyAway) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\mgmrwmrv.exe -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\180searchassistant (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\180solutions (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\zango (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\seekmo (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\SpyAway (Rogue.SpyAway) -> Quarantined and deleted successfully.
C:\WINDOWS\PerfInfo (Rogue.WinPerformance) -> Quarantined and deleted successfully.
C:\Program Files\XPdefender (Rogue.XPDefender) -> Quarantined and deleted successfully.
C:\Program Files\QdrDrive (Adware.AdBand) -> Quarantined and deleted successfully.
C:\Program Files\ISM (Adware.ISM) -> Quarantined and deleted successfully.
C:\Program Files\QdrModule (Adware.ISM) -> Quarantined and deleted successfully.
C:\Program Files\QdrPack (Adware.ISM) -> Quarantined and deleted successfully.
C:\Documents and Settings\ctrq154\Start Menu\Programs\Internet Speed Monitor (Adware.AdSponsor) -> Quarantined and deleted successfully.
C:\Documents and Settings\ctrq154\Start Menu\Programs\Outerinfo (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\SpyAway (Rogue.SpyAway) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Rabio\Search Enhancer (Adware.SearchEnhancer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\XPdefender (Rogue.XPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\ctrq154\Application Data\XPdefender (Rogue.XPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\ctrq154\Application Data\XPdefender\logs (Rogue.XPDefender) -> Quarantined and deleted successfully.

Files Infected:
c:\program files\xpdefender\xpdefender.exe (Rogue.XPDefender) -> Quarantined and deleted successfully.
C:\Program Files\SpyAway\clsReg.dll (Rogue.SpyMaxx) -> Quarantined and deleted successfully.
C:\Program Files\Bat\Bat.dll (Adware.Batco) -> Delete on reboot.
C:\Documents and Settings\ctrq154\Local Settings\Temp\ismtpa11.exe (Adware.ISM) -> Quarantined and deleted successfully.
C:\Documents and Settings\ctrq154\Local Settings\Temp\outerinfo.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\Program Files\Bat\un_BatSetup_15041.exe (Adware.Rabio) -> Quarantined and deleted successfully.
C:\Program Files\ISM\ism.exe (Adware.ISM) -> Quarantined and deleted successfully.
C:\Program Files\ISM\Uninstall.exe (Adware.ISM) -> Quarantined and deleted successfully.
C:\Program Files\QdrDrive\qdrloader.exe (Adware.SearchAid) -> Quarantined and deleted successfully.
C:\Program Files\QdrPack\QdrPack13.exe (Adware.SearchAid) -> Quarantined and deleted successfully.
C:\Program Files\SpyAway\parser.exe (Rogue.SpyAway) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A2A33F73-5691-4B42-967A-6CED14E21C12}\RP110\A0012867.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A2A33F73-5691-4B42-967A-6CED14E21C12}\RP110\A0012868.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\WINDOWS\mrofinu72.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\180searchassistant\saap.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\180searchassistant\sac.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\180solutions\sais.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\zango\zango.exe (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\seekmo\seekmohook.dll (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\Terms.rtf (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\SpyAway\config.dat (Rogue.SpyAway) -> Quarantined and deleted successfully.
C:\Program Files\SpyAway\filesbase.bin (Rogue.SpyAway) -> Quarantined and deleted successfully.
C:\Program Files\SpyAway\gl
  • 1 Contributor
  • 0 Replies
  • 12 Views
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.