Malwarebytes' Anti-Malware 1.40 Database version: 2632 Windows 5.1.2600 Service Pack 3 8/15/2009 11:49:37 PM mbam-log-2009-08-15 (23-49-37).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 161108 Time elapsed: 38 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 1 Registry Keys Infected: 15 Registry Values Infected: 1 Registry Data Items Infected: 3 Folders Infected: 12 Files Infected: 91 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: \\?\globalroot\systemroot\system32\hjgruikxrpewcb.dll (Trojan.TDSS) -> Delete on reboot. Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.AntiVirus2008) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e596df5f-4239-4d40-8367-ebadf0165917} (Rogue.Installer) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b4a78d29-52b1-4a7b-bac0-1471bedf9836} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\AdwareAlert (Rogue.AdwareAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MalwareBot (Rogue.MalwareBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MalwareBot (Rogue.MalwareBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00154c4 (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0081ffe (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c009433e (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ultra soft (Rogue.Multiple) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: system32\sdra64.exe -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully. Folders Infected: C:\Program Files\AdwareAlert (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Quarantine (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Registry Backups (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Settings (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30 (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Registry Backups (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Settings (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot. Files Infected: \\?\globalroot\systemroot\system32\hjgruikxrpewcb.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Documents and Settings\Nora Roberson\Local Settings\Application Data\Google\Google Talk Plugin\redirect\googletalkplugin.exe (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\adwarealert.exe (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\DataBaseNew.ref (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Log\log_2007_01_10_04_14_06.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Log\log_2007_01_10_04_14_08.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Log\log_2007_01_10_07_13_29.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Log\log_2007_01_10_07_20_54.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Log\log_2007_01_11_01_45_24.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Log\log_2007_01_11_01_45_49.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Log\log_2007_01_11_19_39_37.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Log\log_2007_01_11_19_40_16.log (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Settings\CustomScan.stg (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Settings\IgnoreList.stg (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Settings\ScanInfo.stg (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Settings\ScanResults.stg (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Settings\SelectedFolders.stg (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\AdwareAlert\Settings\Settings.stg (Rogue.AdwareAlert) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_14_11_42_20.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_14_11_42_21.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_14_12_02_42.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_14_12_04_15.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_14_12_05_14.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_14_12_36_47.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_16_21_41_12.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_29_02_07_39.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_29_02_08_11.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_29_02_35_07.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_31_01_34_46.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_31_01_35_29.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_31_02_23_38.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_01_31_02_31_01.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\log_2007_02_28_22_24_10.log (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Log\spywarelog.txt (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10000.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10000.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10001.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10001.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10002.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10002.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10003.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10003.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10004.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10004.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10005.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10005.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10006.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10006.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10007.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10007.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10008.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10008.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10009.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10009.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10010.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10010.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10011.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10011.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10012.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10012.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10013.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10013.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10014.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10014.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10015.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10015.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10016.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10016.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10017.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10017.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10018.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10018.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10019.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10019.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10020.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10020.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10021.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10021.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10022.qit (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Quarantine\31-01-2007-01-35-30\10022.qnf (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Settings\CustomScan.stg (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Settings\IgnoreList.stg (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Settings\ScanInfo.stg (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Settings\ScanResults.stg (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Settings\SelectedFolders.stg (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\Program Files\MalwareBot\Settings\Settings.stg (Rogue.MalwareBot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot. C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot. C:\WINDOWS\system32\sdra64.exe (Trojan.FakeAlert) -> Delete on reboot. C:\WINDOWS\inf\ultra.inf (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\inf\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully.