Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5623

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

3/18/2011 4:12:30 PM
mbam-log-2011-03-18 (16-12-23).txt

Scan type: Full scan (C:\|)
Objects scanned: 350446
Time elapsed: 43 minute(s), 0 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 3
Registry Values Infected: 3
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
c:\Users\owner\AppData\Roaming\Ilxiih\orgeo.exe (Trojan.ZbotR.Gen) -> 4584 -> No action taken.

Memory Modules Infected:
c:\Users\owner\AppData\Local\rpat3a.dll (Trojan.Hiloti) -> No action taken.
c:\Users\owner\AppData\Local\utezivazover.dll (Trojan.Agent.U) -> No action taken.

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ngugexet (Trojan.Hiloti) -> Value: Ngugexet -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ncofuxiset (Trojan.Agent.U) -> Value: Ncofuxiset -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{BC2F2A48-F44B-F944-CBC5-80939FD9F642} (Trojan.ZbotR.Gen) -> Value: {BC2F2A48-F44B-F944-CBC5-80939FD9F642} -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Bad: ([removed]) Good: () -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Bad: ([removed]) Good: () -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A7C20682-C0E4-43C9-9FF0-6F719E590F74}\DhcpNameServer (Trojan.DNSChanger) -> Bad: ([removed]) Good: () -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A7C20682-C0E4-43C9-9FF0-6F719E590F74}\DhcpNameServer (Trojan.DNSChanger) -> Bad: ([removed]) Good: () -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\owner\AppData\Local\rpat3a.dll (Trojan.Hiloti) -> No action taken.
c:\Users\owner\AppData\Local\Temp\715B.tmp (Trojan.Hiloti) -> No action taken.
c:\Users\owner\AppData\Local\Temp\swancmexor.exe (Trojan.Hiloti) -> No action taken.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> No action taken.
c:\Windows\Tasks\{62c40aa6-4406-467a-a5a5-dfdf1b559b7a}.job (Trojan.FakeAlert) -> No action taken.
c:\Windows\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> No action taken.
c:\Users\owner\AppData\Local\utezivazover.dll (Trojan.Agent.U) -> No action taken.
c:\Users\owner\AppData\Roaming\Ilxiih\orgeo.exe (Trojan.ZbotR.Gen) -> No action taken.