i need a log check up ASAP

[krazyq]

Logfile of HijackThis v1.99.1
Scan saved at 12:11:48 AM, on 8/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Winamp\Winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\OWNER~1.YOU\LOCALS~1\Temp\Rar$EX00.623\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://ccc.trendmicro.com/personal/en-us/Page/MyPortal/ForgetPWD.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2006\pccguide.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WorkFlow] E:\installs\BrdJmp\WorkFlow.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\WhenUSearch\whse.exe"
O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe"
O4 - HKLM\..\Run: [vssms32] C:\WINDOWS\system32\vssms32.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [McafWelcome] C:\Program Files\McAfee.com\Agent\mcwelcom.exe
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1156121300\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Back ups\My Backup -- 06-08-20 0512PM\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1156222953980
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

My antivirus wont work, and system restore is disabled and i can't restart in safe mode. PLZ HELP
thank you

-Qasim Haji

 

[talldude123]

Install an antivirus program, there are lots out there for free, located in my signature below are a few. There is no excuse to not having antivirus installed.

Also make sure that your firewall is enabled in Windows XP.

Fix the following entries using HiJackThis:

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE Spyware caused by sound card

O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\WhenUSearch\whse.exe" Ad-Ware

O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe" Ad-Ware

O4 - HKLM\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe - Sanker Virus - Remove Immediately

 

[Jam3s-Zer0]

krazyq - You have been infected with the Troj/Bdoor-YP trojan. This has the following effects on your PC:

Allows others to access the computer
Drops more malware
Reduces system security

Some people say your computer is never safe after having a trojan like this.

I recommend a complete reformat. If you cannot/do not want to reformat please let me know and i'll get to work cleaning your PC.


Talldude123 -
How did you miss a Backdoor Trojan from this log?

Also were you not going to tell him to delete the virus?

You can't just fix an 04 using HijackThis and expect the virus to be deleted. If you didn't know, this is what happens when HijackThis fixs an startup entry:
Registry value is deleted, will remove the link but will NOT touch the executable it is pointing to. If the .exe is actually in the Startup directory, it will be removed.

 

[krazyq]

alright i downloaded anti software programme. I did what you guys told me to. I scanned my whole computer with the spyware and anti-virus and this is my log now... is there still hope to get everything out?

I do NOT want to reformat my pc.

 

[krazyq]

This is my logfile now

Logfile of HijackThis v1.99.1
Scan saved at 4:06:35 PM, on 8/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://ccc.trendmicro.com/personal/en-us/Page/MyPortal/ForgetPWD.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1156222953980
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

 

[Jam3s-Zer0]

Ok then..give me a few minutes and i'll try sort you out.

 

[Jam3s-Zer0]

Could you tell me if these folders/files exist still exist..
**(enable the viewing of hidden folders before doing this)**

C:\Program Files\WhenUSearch
C:\WINDOWS\RunDLL32.exe
C:\WINDOWS\system32\vssms32.exe

Kaspersky and ewido have lived up to their name of one of the best anti virus and one of the best trojan removers and done most of the cleaning.

Please run this online scan and post the results of it :

http://www.pandasoftware.com/products/activescan.htm

 

[krazyq]

im sorry for taking so long, i had to work the whole day and now im performing the panda scan, and it looks like it will take a while.
I looked in the folders and was not able to find the files u asked me to look for.

So for the scan has found 28spyware and 1 hacking tool. What should i do after the scan...?

 

[Jam3s-Zer0]

Just checking you enabled the viewing of hidden folders from folder options?

Did Panda scan give you a report which you can copy/paste here so I can see what you have.

 

[krazyq]

this is the result of the scan

Incident Status Location

Spyware:Cookie/Atwola Not disinfected C:\Back ups\My Backup -- 06-08-20 0512PM\WINDOWS\My Backup -- 06-06-23 0144AM\Documents and Settings\Owner\Cookies\owner@atwola[1].txt
Spyware:Cookie/Azjmp Not disinfected C:\Back ups\My Backup -- 06-08-20 0512PM\WINDOWS\My Backup -- 06-06-23 0144AM\Documents and Settings\Owner\Cookies\owner@azjmp[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Back ups\My Backup -- 06-08-20 0512PM\WINDOWS\My Backup -- 06-06-23 0144AM\Documents and Settings\Owner\Cookies\owner@belnk[1].txt
Spyware:Cookie/Go Not disinfected C:\Back ups\My Backup -- 06-08-20 0512PM\WINDOWS\My Backup -- 06-06-23 0144AM\Documents and Settings\Owner\Cookies\owner@go[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Back ups\My Backup -- 06-08-20 0512PM\WINDOWS\My Backup -- 06-06-23 0144AM\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@atwola[2].txt
Spyware:Cookie/Banner Not disinfected C:\Back ups\My Backup -- 06-08-20 0512PM\WINDOWS\My Backup -- 06-06-23 0144AM\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@banner[2].txt
Spyware:Cookie/Target Not disinfected C:\Back ups\My Backup -- 06-08-20 0512PM\WINDOWS\My Backup -- 06-06-23 0144AM\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@target[2].txt
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.com.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[as1.falkag.de/]
Spyware:Cookie/Valueclick Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.valueclick.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.advertising.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Application Data\Mozilla\Firefox\Profiles\6qiw5yzd.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Cookies\owner@ads.addynamix[1].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Cookies\owner@ads.pointroll[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Cookies\owner@atdmt[2].txt
Spyware:Cookie/Coremetrics Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Cookies\owner@data.coremetrics[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Cookies\owner@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Cookies\owner@mediaplex[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Cookies\owner@questionmarket[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Owner.YOUR-763AF0904D\Desktop\SmitfraudFix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Zips And Setups\SmitfraudFix.zip[SmitfraudFix/Process.exe]