Malwarebytes' Anti-Malware 1.23
Database version: 985
Windows 5.1.2600 Service Pack 3

6:22:27 PM 7/25/2008
mbam-log-7-25-2008 (18-22-27).txt

Scan type: Full Scan (C:\|G:\|)
Objects scanned: 178437
Time elapsed: 42 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 30

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\ddcayAqN.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{df2f1b1a-3114-4c02-90c0-2cd77a44fb6e} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{df2f1b1a-3114-4c02-90c0-2cd77a44fb6e} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{487c9905-26a8-42c8-8033-c58ad3d2aec3} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{487c9905-26a8-42c8-8033-c58ad3d2aec3} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{487c9905-26a8-42c8-8033-c58ad3d2aec3} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\ddcayaqn -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ddcayaqn  -> Delete on reboot.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\ddcayAqN.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\NqAyacdd.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NqAyacdd.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041734.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041735.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041736.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041737.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041738.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041739.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041740.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041741.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041742.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041743.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041744.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP50\A0041745.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP51\A0042660.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP51\A0042661.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP51\A0042662.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP53\A0071776.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP53\A0071777.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP53\A0071778.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP54\A0074789.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP54\A0074792.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP54\A0074793.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP54\A0074796.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP54\A0074797.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP54\A0074799.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP54\A0074800.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP54\A0074803.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{06349871-252C-46E6-8FC5-CD10CE627396}\RP55\A0076932.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.