Hijackthis Log - Spybot Can't Get Rid Of Virtumonde - Help![RESOLVED]


Recommended Posts

Hi, I'm Ryan, and I'll be helping you from here, cuz MoNsTeReNeRgY22 is leaving for vacation (lucky dog).

How is the computer running?

Can you please scan with combofix again, and post the log from that, as well as a new HiJackThis log, and I'll take a look at what needs to be done from there.

-Ryan

Link to post
Share on other sites

The computer is running okay, but is not totally normal. There is no list after All Programs in the start menu, there is no recycle bin and the modem is not functioning. If I type an incorrect url in the Mozilla Firefox browser, it will seem to hang with a connection dialog and then nothing works until the browser is closed and started again. When I print a document, I get a Windows Installer dialog that I have to cancel and close, but it still prints.

The ComboFix did not restart the computer this time, so I hope it means we're making progress.

ComboFix.txt

ComboFix 07-11-08.1 - Toomay Technologies 2007-11-14 20:39:07.5 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.490 [GMT -8:00]

Running from: C:\Documents and Settings\Toomay Technologies\Desktop\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))

.

2007-11-12 19:37 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan

2007-11-11 11:38 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab

2007-11-11 11:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab

2007-11-10 12:27 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-11-10 11:35 <DIR> d-------- C:\Deckard

2007-11-07 21:01 <DIR> d-------- C:\HJT

2007-11-07 19:58 <DIR> d-------- C:\Documents and Settings\Toomay Technologies\Application Data\Lavasoft

2007-11-07 19:57 <DIR> d-------- C:\Program Files\Lavasoft

2007-11-07 17:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

2007-11-07 14:36 <DIR> d--hs---- C:\GA6P

2007-11-07 14:30 8,704 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll

2007-11-07 12:47 <DIR> d-------- C:\Program Files\InCode Solutions

2007-11-07 10:29 <DIR> d-------- C:\Program Files\NoAdware5.0

2007-11-07 07:17 128,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmgr.sys

2007-11-07 07:17 23,040 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmc.exe

2007-11-07 07:17 16,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltlib.dll

2007-11-07 07:07 <DIR> d-------- C:\Program Files\MSXML 4.0

2007-11-06 22:22 584,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll

2007-11-06 21:39 271,224 --a------ C:\WINDOWS\SYSTEM32\mucltui.dll

2007-11-06 21:25 22,112 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\COH_Mon.sys

2007-10-30 19:55 625,032 --a------ C:\WINDOWS\SYSTEM32\SymNeti.dll

2007-10-30 19:55 242,056 --a------ C:\WINDOWS\SYSTEM32\SymRedir.dll

2007-10-30 19:55 191,536 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symtdi.sys

2007-10-30 19:55 145,968 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symfw.sys

2007-10-30 19:55 39,856 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symids.sys

2007-10-30 19:55 37,936 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symndisv.sys

2007-10-30 19:55 35,120 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symndis.sys

2007-10-30 19:55 27,696 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symredrv.sys

2007-10-30 19:55 12,848 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symdns.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-11-15 01:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2007-11-15 01:10 --------- d-----w C:\Documents and Settings\Toomay Technologies\Application Data\MSN6

2007-11-13 04:01 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

2007-11-10 22:44 --------- d-----w C:\Program Files\Sagekey Software

2007-11-07 05:20 --------- d-----w C:\Program Files\Symantec

2007-11-07 05:19 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF

2007-11-07 05:19 60,800 ----a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL

2007-11-07 05:19 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS

2007-11-07 05:19 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT

2007-10-31 03:24 12,963 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat

2007-10-31 03:24 1,358 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf

2007-09-18 22:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat

2007-09-18 22:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat

2007-09-18 22:44 10,658 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat

2007-09-18 22:44 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf

2007-09-18 22:44 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf

2007-09-18 22:44 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf

2007-09-18 22:43 43,696 ----a-w C:\WINDOWS\system32\drivers\srtspx.sys

2007-09-18 22:43 317,616 ----a-w C:\WINDOWS\system32\drivers\srtspl.sys

2007-09-18 22:43 278,576 ----a-w C:\WINDOWS\system32\drivers\srtsp.sys

2007-08-22 13:12 96,256 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll

2007-08-22 13:12 658,944 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll

2007-08-22 13:12 615,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll

2007-08-22 13:12 55,808 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll

2007-08-22 13:12 532,480 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll

2007-08-22 13:12 474,112 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll

2007-08-22 13:12 449,024 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll

2007-08-22 13:12 39,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll

2007-08-22 13:12 357,888 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll

2007-08-22 13:12 3,058,176 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll

2007-08-22 13:12 251,392 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll

2007-08-22 13:12 205,312 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll

2007-08-22 13:12 16,384 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll

2007-08-22 13:12 151,040 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll

2007-08-22 13:12 146,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll

2007-08-22 13:12 1,494,528 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll

2007-08-22 13:12 1,054,208 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll

2007-08-22 13:12 1,022,976 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll

2007-08-21 10:30 18,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe

2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll

2007-08-21 06:15 683,520 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll

.

((((((((((((((((((((((((((((( snapshot@2007-11-10_12.41.46.23 )))))))))))))))))))))))))))))))))))))))))

.

+ 2006-08-24 16:28:54 141,424 ----a-w C:\WINDOWS\Downloaded Program Files\asinst.dll

+ 2007-03-29 17:20:50 110,592 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\as.dll

+ 2006-10-06 00:15:26 233,472 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\ascontrol.dll

+ 2005-06-03 22:03:18 96,256 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\asmdat.dll

+ 2003-08-01 19:00:16 36,864 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\certdll.dll

+ 2005-05-20 21:42:44 86,016 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\instlsp.dll

+ 2006-02-17 02:20:20 4,608 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\memvfile.dll

+ 2005-10-26 02:08:32 348,160 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\msvcr71.dll

+ 2004-05-04 23:01:02 139,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavaleas.dll

+ 2006-07-14 21:04:10 45,056 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavdr.exe

+ 2006-04-10 18:50:02 159,832 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavexcom.dll

+ 2006-02-14 21:05:38 94,208 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavinas.dll

+ 2006-02-17 02:35:38 180,224 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavoe.dll

+ 2006-10-06 00:15:38 122,880 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavpz.dll

+ 2006-06-30 22:13:38 8,704 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pfdnnt.exe

+ 2004-02-04 22:08:42 49,152 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\port32.dll

+ 2006-08-01 21:23:10 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pscpu.dll

+ 2006-08-23 21:06:08 1,388,544 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskahk.dll

+ 2006-08-17 19:38:14 10,752 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskalloc.dll

+ 2006-09-04 19:49:54 61,440 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskas.dll

+ 2006-08-18 16:46:18 779,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskavs.dll

+ 2007-03-26 22:25:34 417,792 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskcmp.dll

+ 2006-08-09 18:42:24 90,112 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskfss.dll

+ 2006-07-19 18:55:58 208,896 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskhtml.dll

+ 2006-01-21 00:57:00 9,728 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmas.dll

+ 2006-05-17 17:50:12 14,336 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmdfs.dll

+ 2006-08-16 18:58:12 33,280 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskpack.dll

+ 2006-06-30 22:42:36 266,240 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskscs.dll

+ 2006-08-17 22:33:14 62,976 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskutil.dll

+ 2006-08-08 21:13:10 13,312 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfile.dll

+ 2006-08-18 16:53:08 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfs.dll

+ 2006-08-18 16:49:50 167,936 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvm.dll

+ 2007-04-19 01:16:04 353,840 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psscan.dll

+ 2007-01-22 22:42:48 35,328 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\rawvfile.dll

+ 1997-09-18 14:12:32 9,488 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\sporder.dll

+ 2006-03-01 01:23:40 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\tcpvfile.dll

+ 2006-08-02 20:39:06 73,728 ----a-w C:\WINDOWS\SYSTEM32\asuninst.exe

+ 2005-05-24 20:27:16 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll

+ 2007-08-29 23:47:20 94,208 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe

+ 2007-08-29 23:49:54 950,272 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll

+ 2003-03-26 02:53:50 11,776 ----a-w C:\WINDOWS\SYSTEM32\ZPORT4AS.dll

.

-- Snapshot reset to current date --

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C1DD717-53B2-485E-A17B-C9977C205E10}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF4535AA-6BBA-4B92-9F85-7A5488F03926}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2FB8A5C-CEC8-4E21-93F3-FF0CE1331C86}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 09:19]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 21:59]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24]

"LDM"="D:\Apps\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" []

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

"RemoveIT Pro v4Ent"="C:\Program Files\InCode Solutions\RemoveIT Pro v4\removeit.exe" [2007-11-07 15:28]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

R2 ASFAgent;ASF Agent;C:\Program Files\Intel\ASF Agent\ASFAgent.exe

R2 AsfAlrt;AsfAlrt;\??\C:\WINDOWS\System32\drivers\AsfAlrt.sys

S3 HPFXBULK;HPFXBULK;C:\WINDOWS\system32\drivers\hpfxbulk.sys

*Newly Created Service* - COMHOST

.

Contents of the 'Scheduled Tasks' folder

"2007-11-13 04:00:48 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Toomay Technologies.job"

- D:\Apps\NortonAV7\Norton AntiVirus\Navw32.exe

.

**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-11-14 20:41:26

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

.

Completion time: 2007-11-14 20:42:40

C:\ComboFix2.txt ... 2007-11-11 10:50

C:\ComboFix3.txt ... 2007-11-10 12:43

.

--- E O F ---

Hijackthis Log.txt

ComboFix 07-11-08.1 - Toomay Technologies 2007-11-14 20:39:07.5 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.490 [GMT -8:00]

Running from: C:\Documents and Settings\Toomay Technologies\Desktop\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))

.

2007-11-12 19:37 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan

2007-11-11 11:38 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab

2007-11-11 11:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab

2007-11-10 12:27 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-11-10 11:35 <DIR> d-------- C:\Deckard

2007-11-07 21:01 <DIR> d-------- C:\HJT

2007-11-07 19:58 <DIR> d-------- C:\Documents and Settings\Toomay Technologies\Application Data\Lavasoft

2007-11-07 19:57 <DIR> d-------- C:\Program Files\Lavasoft

2007-11-07 17:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

2007-11-07 14:36 <DIR> d--hs---- C:\GA6P

2007-11-07 14:30 8,704 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll

2007-11-07 12:47 <DIR> d-------- C:\Program Files\InCode Solutions

2007-11-07 10:29 <DIR> d-------- C:\Program Files\NoAdware5.0

2007-11-07 07:17 128,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmgr.sys

2007-11-07 07:17 23,040 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltmc.exe

2007-11-07 07:17 16,896 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\fltlib.dll

2007-11-07 07:07 <DIR> d-------- C:\Program Files\MSXML 4.0

2007-11-06 22:22 584,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll

2007-11-06 21:39 271,224 --a------ C:\WINDOWS\SYSTEM32\mucltui.dll

2007-11-06 21:25 22,112 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\COH_Mon.sys

2007-10-30 19:55 625,032 --a------ C:\WINDOWS\SYSTEM32\SymNeti.dll

2007-10-30 19:55 242,056 --a------ C:\WINDOWS\SYSTEM32\SymRedir.dll

2007-10-30 19:55 191,536 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symtdi.sys

2007-10-30 19:55 145,968 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symfw.sys

2007-10-30 19:55 39,856 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symids.sys

2007-10-30 19:55 37,936 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symndisv.sys

2007-10-30 19:55 35,120 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symndis.sys

2007-10-30 19:55 27,696 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symredrv.sys

2007-10-30 19:55 12,848 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\symdns.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-11-15 01:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2007-11-15 01:10 --------- d-----w C:\Documents and Settings\Toomay Technologies\Application Data\MSN6

2007-11-13 04:01 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

2007-11-10 22:44 --------- d-----w C:\Program Files\Sagekey Software

2007-11-07 05:20 --------- d-----w C:\Program Files\Symantec

2007-11-07 05:19 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF

2007-11-07 05:19 60,800 ----a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL

2007-11-07 05:19 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS

2007-11-07 05:19 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT

2007-10-31 03:24 12,963 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat

2007-10-31 03:24 1,358 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf

2007-09-18 22:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat

2007-09-18 22:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat

2007-09-18 22:44 10,658 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat

2007-09-18 22:44 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf

2007-09-18 22:44 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf

2007-09-18 22:44 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf

2007-09-18 22:43 43,696 ----a-w C:\WINDOWS\system32\drivers\srtspx.sys

2007-09-18 22:43 317,616 ----a-w C:\WINDOWS\system32\drivers\srtspl.sys

2007-09-18 22:43 278,576 ----a-w C:\WINDOWS\system32\drivers\srtsp.sys

2007-08-22 13:12 96,256 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll

2007-08-22 13:12 658,944 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll

2007-08-22 13:12 615,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll

2007-08-22 13:12 55,808 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll

2007-08-22 13:12 532,480 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll

2007-08-22 13:12 474,112 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll

2007-08-22 13:12 449,024 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll

2007-08-22 13:12 39,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll

2007-08-22 13:12 357,888 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll

2007-08-22 13:12 3,058,176 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll

2007-08-22 13:12 251,392 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll

2007-08-22 13:12 205,312 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll

2007-08-22 13:12 16,384 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll

2007-08-22 13:12 151,040 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll

2007-08-22 13:12 146,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll

2007-08-22 13:12 1,494,528 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll

2007-08-22 13:12 1,054,208 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll

2007-08-22 13:12 1,022,976 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll

2007-08-21 10:30 18,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe

2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll

2007-08-21 06:15 683,520 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll

.

((((((((((((((((((((((((((((( snapshot@2007-11-10_12.41.46.23 )))))))))))))))))))))))))))))))))))))))))

.

+ 2006-08-24 16:28:54 141,424 ----a-w C:\WINDOWS\Downloaded Program Files\asinst.dll

+ 2007-03-29 17:20:50 110,592 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\as.dll

+ 2006-10-06 00:15:26 233,472 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\ascontrol.dll

+ 2005-06-03 22:03:18 96,256 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\asmdat.dll

+ 2003-08-01 19:00:16 36,864 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\certdll.dll

+ 2005-05-20 21:42:44 86,016 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\instlsp.dll

+ 2006-02-17 02:20:20 4,608 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\memvfile.dll

+ 2005-10-26 02:08:32 348,160 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\msvcr71.dll

+ 2004-05-04 23:01:02 139,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavaleas.dll

+ 2006-07-14 21:04:10 45,056 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavdr.exe

+ 2006-04-10 18:50:02 159,832 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavexcom.dll

+ 2006-02-14 21:05:38 94,208 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavinas.dll

+ 2006-02-17 02:35:38 180,224 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavoe.dll

+ 2006-10-06 00:15:38 122,880 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavpz.dll

+ 2006-06-30 22:13:38 8,704 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pfdnnt.exe

+ 2004-02-04 22:08:42 49,152 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\port32.dll

+ 2006-08-01 21:23:10 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pscpu.dll

+ 2006-08-23 21:06:08 1,388,544 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskahk.dll

+ 2006-08-17 19:38:14 10,752 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskalloc.dll

+ 2006-09-04 19:49:54 61,440 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskas.dll

+ 2006-08-18 16:46:18 779,264 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskavs.dll

+ 2007-03-26 22:25:34 417,792 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskcmp.dll

+ 2006-08-09 18:42:24 90,112 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskfss.dll

+ 2006-07-19 18:55:58 208,896 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskhtml.dll

+ 2006-01-21 00:57:00 9,728 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmas.dll

+ 2006-05-17 17:50:12 14,336 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmdfs.dll

+ 2006-08-16 18:58:12 33,280 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskpack.dll

+ 2006-06-30 22:42:36 266,240 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskscs.dll

+ 2006-08-17 22:33:14 62,976 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskutil.dll

+ 2006-08-08 21:13:10 13,312 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfile.dll

+ 2006-08-18 16:53:08 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfs.dll

+ 2006-08-18 16:49:50 167,936 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvm.dll

+ 2007-04-19 01:16:04 353,840 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\psscan.dll

+ 2007-01-22 22:42:48 35,328 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\rawvfile.dll

+ 1997-09-18 14:12:32 9,488 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\sporder.dll

+ 2006-03-01 01:23:40 69,632 ----a-w C:\WINDOWS\SYSTEM32\ActiveScan\tcpvfile.dll

+ 2006-08-02 20:39:06 73,728 ----a-w C:\WINDOWS\SYSTEM32\asuninst.exe

+ 2005-05-24 20:27:16 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll

+ 2007-08-29 23:47:20 94,208 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe

+ 2007-08-29 23:49:54 950,272 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll

+ 2003-03-26 02:53:50 11,776 ----a-w C:\WINDOWS\SYSTEM32\ZPORT4AS.dll

.

-- Snapshot reset to current date --

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C1DD717-53B2-485E-A17B-C9977C205E10}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF4535AA-6BBA-4B92-9F85-7A5488F03926}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2FB8A5C-CEC8-4E21-93F3-FF0CE1331C86}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 09:19]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 21:59]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24]

"LDM"="D:\Apps\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" []

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

"RemoveIT Pro v4Ent"="C:\Program Files\InCode Solutions\RemoveIT Pro v4\removeit.exe" [2007-11-07 15:28]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

R2 ASFAgent;ASF Agent;C:\Program Files\Intel\ASF Agent\ASFAgent.exe

R2 AsfAlrt;AsfAlrt;\??\C:\WINDOWS\System32\drivers\AsfAlrt.sys

S3 HPFXBULK;HPFXBULK;C:\WINDOWS\system32\drivers\hpfxbulk.sys

*Newly Created Service* - COMHOST

.

Contents of the 'Scheduled Tasks' folder

"2007-11-13 04:00:48 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Toomay Technologies.job"

- D:\Apps\NortonAV7\Norton AntiVirus\Navw32.exe

.

**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-11-14 20:41:26

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

.

Completion time: 2007-11-14 20:42:40

C:\ComboFix2.txt ... 2007-11-11 10:50

C:\ComboFix3.txt ... 2007-11-10 12:43

.

--- E O F ---

Edited by DaDooDaidy
Link to post
Share on other sites

== Clear Temporary Files ==

Please download ATF Cleaner by Atribune.

This program is for XP and Windows 2000 only

  • Close all Internet Explorer, Firefox, and Opera windows before continuing.
    Double-click ATF-Cleaner.exe to run the program.
    Under Main choose: Select All
    Click the Empty Selected button.

If you use Firefox browser

  • Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

  • Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

For Technical Support, double-click the e-mail address located at the bottom of each menu.

== Kaspersky Web Scanner ==

Please do an online scan with Kaspersky WebScanner

You will need to use Internet Explorer to do this

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT

  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:

    • Extended (if available otherwise Standard)

    • Scan Options:

    • Scan Archives
      Scan Mail Bases

    [*]Click OK

    [*]Now under select a target to scan:

    • Select My Computer

    [*]This will program will start and scan your system.

    [*]The scan will take a while so be patient and let it run.

    [*]Once the scan is complete it will display if your system has been infected.

    • Now click on the Save as Text button:

    [*]Save the file to your desktop.

== Request Logs ==

Please post the log from the Kaspersky scan.

-Ryan

Link to post
Share on other sites

When I did the ATF cleaner, there was no option for FireFox or Opera. I'm using FireFox and I have no passwords stored anyway. It still seemed to work, because it cleaned 30,691 MBs.

Then I did the Kaspersky scan. Is it getting better?

I don't know most of those email addresses. It was from a list server group. Someone went on vacation once and the auto reply message probably kept sending out a virus. Yikes!

Kaspersky results...

-------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER REPORT

Friday, November 16, 2007 7:35:12 AM

Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.98.0

Kaspersky Anti-Virus database last update: 16/11/2007

Kaspersky Anti-Virus database records: 460197

-------------------------------------------------------------------------------

Scan Settings:

Scan using the following antivirus database: extended

Scan Archives: true

Scan Mail Bases: true

Scan Target - My Computer:

A:\

C:\

D:\

E:\

F:\

J:\

Z:\

Scan Statistics:

Total number of scanned objects: 111223

Number of viruses found: 18

Number of infected objects: 264

Number of suspicious objects: 0

Duration of the scan process: 08:39:22

Infected Object Name / Virus Name / Last Action

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-11-15_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\index.qbs Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\59DCE333.TMP Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\abook.mab Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\Cache\_CACHE_001_ Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\Cache\_CACHE_002_ Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\Cache\_CACHE_003_ Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\Cache\_CACHE_MAP_ Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\panacea.dat Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\parent.lock Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Cookies\INDEX.DAT Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\Toomay Technologies\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\Toomay Technologies\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped

C:\Documents and Settings\Toomay Technologies\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Local Settings\History\History.IE5\MSHist012007111520071116\index.dat Object is locked skipped

C:\Documents and Settings\Toomay Technologies\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Toomay Technologies\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Toomay Technologies\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092861.old Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092862.old Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092871.old Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092904.exe Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092905.sys Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092906.sys Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092907.dll Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092955.exe Infected: not-a-virus:Downloader.Win32.WinFixer.at skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0092992.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093004.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093007.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093115.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ahr skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093116.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0093120.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ahr skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0070.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0071.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0072.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0073.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe/WISE0074.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe WiseSFX: infected - 11 skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104377.exe WiseSFX Dropper: infected - 11 skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0084.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0084.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0084.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0087.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0087.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0087.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0088.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0089.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0090.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe/WISE0091.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.i skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe WiseSFX: infected - 16 skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0104386.exe WiseSFX Dropper: infected - 16 skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0105525.exe Infected: not-a-virus:Downloader.Win32.WinFixer.au skipped

C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\HPPDEVX.DLL.log Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\T30DebugLogFile.txt Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

D:\Apps\NortonAV7\Norton AntiVirus\AVApp.log Object is locked skipped

D:\Apps\NortonAV7\Norton AntiVirus\AVError.log Object is locked skipped

D:\Apps\NortonAV7\Norton AntiVirus\AVVirus.log Object is locked skipped

D:\Apps\timbuktupro\Activity.log Object is locked skipped

D:\Apps\timbuktupro\Personal.tbk Object is locked skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F ... /[From "Pearl Meade" <[email protected]>][Date Wed, 11 May 2005 15:10:19 +0500]/html Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . . ... ... /[From "Tom Plummer" <[email protected]>][Date Tue, 10 May 2005 13:36:10 -0500]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . . ... /[From "Bianca Francis" <[email protected]>][Date Fri, 06 May 2005 17:14:25 -0500]/html Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . ... /[Fr ... /[From Tim Toomay <[email protected]>][Date Thu, 05 May 2005 11:14:56 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . ... /[From ... /[From "Douglas Webb" <[email protected]>][Date Thu, 5 May 2005 12:26:22 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . ... /[From ... /[From Dora Camacho <[email protected]>][Date Wed, 04 May 2005 21:38:42 +0200]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F . ... /[From "Wilmer Bergeron" <[email protected]>][Date Wed, 04 May 2005 07:45:47 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[F ... /[From "claribel isene" <[email protected]>][Date Tue, 3 May 2005 04:44:10 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[Fro ... /[From "Anahi Santiago" <[email protected]>][Date Tue, 03 May 2005 16:49:35 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNN ... /[From "Gregorio Olsen" <[email protected]>][Date Mon, 02 May 2005 19:52:42 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:1 ... /[From "SunTrust Bank, Inc." <[email protected]>][Date Wed, 06 Sep 2006 11:58:38 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.qb skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAME ... /[From "Gas Station Critics" <[email protected]>][Date Wed, 6 Sep 2006 12:56:23 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.qb skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[ ... / ... /[From "zeidemik.com" <[email protected]>][Date Wed, 6 Sep 2006 12:43:40 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.qb skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[ ... /[From Wine Connoisseurs<[email protected]>][Date 06 Sep 2006 12:37:47 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.qb skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08 ... /[From "Branch Banking and Trust" <[email protected]>][Date Mon, 19 Mar 2007 22:35:25 -0400 ( ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08 ... /[From "Branch Banking and Trust" <[email protected]>][Date Mon, 19 Mar 2007 22:35:25 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[F ... /[From "Zpmill tutelage" <[email protected]>][Date Mon, 19 Mar 2007 22:12:25 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[F ... /[ . ... /[From Thomas S. Nolan <[email protected]>][Date Tue, 20 Mar 2007 10:11:34 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[F ... /[ ... /[From artyku" <[email protected]>][Date 20 Mar 2007 03:13:01 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[F ... /[From "Lila Milligan" <[email protected]>][Date Mon, 19 Mar 2007 21:55:08 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[From "123 ... /[From "Ryan" <[email protected]>][Date Mon, 19 Mar 2007 20:22:22 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... ... /[From "123Inkjets" <[email protected]>][Date Mon, 19 Mar 2007 17:31:54 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... /[F ... /[From "Rqeccles field" <[email protected]>][Date Wed, 14 Feb 2007 05:25:05 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro .. ... /[From "Lncommandeer corrode" <[email protected]>][Date Mon, 19 Mar 2007 15:24:44 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From ... /[Fro ... /[From "Bidz" <[email protected]>][Date Mon, 19 Mar 2007 17:06:25 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From ... /[From Anita Holley <[email protected]>][Date Mon, 19 Mar 2007 21:13:32 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From "Warran ... /[From "Buddy" <[email protected]>][Date Tue, 20 Mar 2007 06:53:11 + ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From "Warran ... /[From "Buddy" <[email protected]>][Date Tue, 20 Mar 2007 06:53:11 +1100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From "WarrantyOptio ... /[From trim <[email protected]>][Date Mon, 19 Mar 2007 20:51:46 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[Fro ... /[From "WarrantyOptions" <[email protected]>][Date Mon, 19 Mar 2007 10:11:50 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "WarrantyOptions" <[email protected]>][Date Mon, 19 Mar 2007 08:31:38 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... ... /[From "Foreman" <[email protected]>][Date Mon, 19 Mar 2007 08:07:33 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[F ... ... /[From "Stephen" <[email protected]>][Date Mon, 19 Mar 2007 11:30:02 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[F ... /[From Barber P. Susan <[email protected]>][Date Mon, 19 Mar 2007 10:51:59 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "Fredrick ... /[From Media" <[email protected]>][Date 19 Mar 2007 10:45:38 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "Fredrick Gipson" <[email protected]>][Date Mon, 19 Mar 2007 08:10:39 - ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "Fredrick Gipson" <[email protected]>][Date Mon, 19 Mar 2007 08:10:39 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou . ... /[From Carol Harrington <[email protected]>][Date Mon, 19 Mar 2007 15:43:45 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou . ... /[From "Eloise Wilder" <[email protected]>][Date Sun, 18 Mar 2007 23:11:24 -050 ... /html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou . ... /[From "Eloise Wilder" <[email protected]>][Date Sun, 18 Mar 2007 23:11:24 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From Baby Offers<[email protected]>][Date 18 Mar 2007 21:59:47 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... / ... /[From Page I. Jean <[email protected]>][Date Mon, 19 Mar 2007 11:23:06 +0900]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "123Inkjets" <[email protected]>][Date Sun, 18 Mar 2007 17:34:05 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... ... ... /[From Reynold D. Hollis <[email protected]>][Date Sun, 18 Mar 2007 16:29:39 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... ... /[From Deon S. Justice <[email protected]>][Date Sun, 18 Mar 2007 14:15:10 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[Fr ... /[From "Darell" <[email protected]>][Date Mon, 19 Mar 2007 06:22:25 +1100]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Tou ... /[From "123Inkjets" <[email protected]>][Date Sun, 18 Mar 2007 15:21:18 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Touch Can O ... /[From "Wayne Haney" <[email protected]>][Date Sun, 18 Mar 2007 13:51:58 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Touch Can Opener" <[email protected]>][Date Sun, 18 Mar 2007 11:31:21 -0600]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "CleverClasp" <[email protected]>][Date Sun, 18 Mar 2007 09:21:25 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[Fro ... /[From Robert A.<[email protected]>][Date 18 Mar 2007 07:13:37 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "DebttoWeal ... /[From [email protected]][Date 9 Mar 2007 23:44:46 +0100]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "DebttoWealth" <Debt ... /[From Talk" <[email protected]>][Date 17 Mar 2007 21:08:46 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "DebttoWealth" <[email protected]>][Date Sat, 17 Mar 2007 19:58:11 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... .. ... /[From "123Inkjets" <[email protected]>][Date Sat, 17 Mar 2007 17:28:56 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... .. ... /[From "CECILIA MCBRIDE" <[email protected]>][Date Sat, 17 Mar 2007 14:03:07 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[F ... /[From Funk Unlimited <[email protected]>][Date 17 Mar 2007 15:03:49 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From "Radius Group" <[email protected]>][Date Sat, 17 Mar 2007 14:54:30 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[Fro ... /[From "DoggySteps" <[email protected]>][Date Sat, 17 Mar 2007 13:28:44 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "Extreme Make ... /[From payable <[email protected]>][Date Sat, 17 Mar 2007 18:27:48 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "Extreme Makeover" ... /[From walk" <[email protected]>][Date 17 Mar 2007 17:25:34 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "Extreme Makeover" <[email protected]>][Date Sat, 17 Mar 2007 07:45:32 -0500 (GMT-05:00)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[Fr ... / ... /[From "eBay" <[email protected]>][Date Sat, 17 Mar 2007 04:33:34 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[Fr ... / ... /[From Gary <[email protected]>][Date Sat, 17 Mar 2007 14:56:36 +0530]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[Fr ... /[From "4Seasons" <[email protected]>][Date Sat, 17 Mar 2007 02:56:27 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... ... /[From [email protected] <[email protected]>][Date 16 Mar 2007 21:16:32 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... / ... /[From "Jewel Hart" <[email protected]>][Date Sat, 17 Mar 2007 02:43:58 + ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... / ... /[From "Jewel Hart" <[email protected]>][Date Sat, 17 Mar 2007 02:43:58 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "ink ... /[From "Bidz" <[email protected]>][Date Fri, 16 Mar 2007 19:36:52 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "ink liquidation sale" <[email protected]>][Date Fri, 16 Mar 2007 15:27:17 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "AppetiteKil ... /[From suicide of <[email protected]>][Date Sat, 17 Mar 2007 21:12:19 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "AppetiteKiller" <[email protected]>][Date Fri, 16 Mar 2007 13:53:22 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "Warranty ... /[From Tim Toomay <[email protected]>][Date Tue, 02 Jan 2007 16:19:41 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "WarrantyOptions" <[email protected]>][Date Fri, 16 Mar 2007 13:21:21 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From ... /[From "NHIC, Corp." <[email protected]>][Date Fri, 16 Mar 2007 12:48:25 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Touch Can Opener" <OneTouch ... /[From Colette <[email protected]>][Date Fri, 16 Mar 2007 09:32:45 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50: ... /[From "One Touch Can Opener" <[email protected]>][Date Fri, 16 Mar 2007 06:56:31 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From ... /[From "Jama Little" <[email protected]>][Date Fri, 16 Mar 2007 17:22:06 +0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burns ... /[From marina <[email protected]>][Date Fri, 16 Mar 2007 10:56:58 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From ... /[From "BB&T" <[email protected]>][Date Wed, 21 Mar 2007 06:47:54 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From "Ambrose Henry" <f .. ... /[From <[email protected]>][Date Wed, 21 Mar 2007 05:17:08 -0600]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From "Ambrose Henry" <f ... /[From JohnEmmy" <[email protected]>][Date 21 Mar 2007 09:49:53 -0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From "Ambrose Henry" <[email protected]>][Date Wed, 21 Mar 2007 10:28:05 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[Fro ... /[From "Ktypewritten wealthy" <[email protected]>][Date Wed, 21 Mar 2007 13:38:42 +0530]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From . ... ... /[From "Elda Thompson" <[email protected]>][Date Tue, 20 Mar 2007 23:44:57 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From . ... /[From iTunes Store <[email protected]>][Date Tue, 20 Mar 2007 23:40:31 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From ... /[Fro ... /[From "Ewast riverbank" <[email protected]>][Date Wed, 21 Mar 2007 12:11:09 +0900]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From ... /[From "anstice ... /[From "Xqrock trot" <[email protected]>][Date Wed, 21 Mar 2007 12:11:21 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From ... /[From "anstice tobin" <[email protected]>][Date Wed, 21 Mar 2007 10:24:41 +0900]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 ... /[From "SatelliteTelevision" <[email protected]>][Date Tue, 20 Mar 2007 18:06:27 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... /[From "123Inkjets" <[email protected]>][Date Tue, 20 Mar 2007 17:28:30 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fro ... /[From "Ydiscrete barbell" <[email protected]>][Date Thu, 18 Jun 1987 04:49:33 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Bu ... /[From Patrick Meadows <[email protected]>][Date Tue, 20 Mar 2007 20:33:53 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "YSO-8859-1?B?T ... /[From "BB&T" <[email protected]>][Date Wed, 21 Mar 2007 22:45:27 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "YSO-8859-1?B?TW9udGFsdm8gQXJ0cyBDZW50ZXI-" <[email protected]>][Date Wed, 21 Mar 2007 18:15:14 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -05 ... /[From "WinterBlowoutSale" <[email protected]>][Date Wed, 21 Mar 2007 18:02:23 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08: ... /[From "Branch Banking and Trust" <[email protected]>][Date Fri, 23 Mar 2007 19:57:11 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... /[From "123Inkjets" <[email protected]>][Date Fri, 23 Mar 2007 18:22:57 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAME ... /[From "SearchSecrets" <[email protected]>][Date Fri, 23 Mar 2007 17:20:20 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "Branch Banking and Trust" <[email protected]>][Date Tue, 27 Mar 2007 16:44:45 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "Branch Banking and Trust" <[email protected]>][Date Tue, 27 Mar 2007 16:43:42 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... / ... /[From "Chris Lehman" <[email protected]>][Date Tue, 27 Mar 2007 20:19:28 -0060]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... /[From "Lotto Secrets" <[email protected]>][Date Tue, 27 Mar 2007 15:44:59 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From ... ... /[From Support Center <[email protected]>][Date Wed, 4 Apr 2007 00:04:54 PST]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From ... /[Fr ... /[From "Hilary Winslow" <[email protected]>][Date Wed, 4 Apr 2007 03:12:45 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From ... /[From "JMDSurveys" <[email protected]>][Date Tue, 3 Apr 2007 1 ... /[Date 6:32:12 PM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From ... /[From "JMDSurveys" <[email protected]>][Date Tue, 3 Apr 2007 16:25:11 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -050 ... /[From "Home Improvement Depot" <[email protected]>][Date Tue, 3 Apr 2007 15:10:41 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "Branch Banking and Trust" <[email protected]>][Date Fri, 06 Apr 2007 14:47:12 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 20 ... /[From "Branch Banking and Trust" <[email protected]>][Date Fri, 6 Apr 2007 18:08:41 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "WarrantyExtensio ... /[From "PCTV" <[email protected]>][Date Fri, 6 Apr 2007 17:59:35 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "WarrantyExtension" <[email protected]>][Date Fri, 6 Apr 2007 15:32:15 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[ . ... /[From "NHIC, Corp." <[email protected]>][Date Fri, 6 Apr 2007 14:25:50 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[ ... /[From "Local Home Listings" <no ... /[From [email protected]][Date Fri, 6 Apr 2007 12:51:55 CDT]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[ ... /[From "Local Home Listings" <[email protected]>][Date Fri, 6 Apr 2007 13:43:37 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From ... /[From ... /[From "Hurry" <[email protected]>][Date Fri, 6 Apr 2007 12:42:53 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From ... /[From "gearedon.com" <[email protected]>][Date Fri, 6 Apr 2007 11:36:42 -0500 (GMT-05:00)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "Com ... /[Fr ... /[From Delbert Platt <[email protected]>][Date Wed, 6 Jun 2007 12:36:44 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "Com ... /[From [email protected] (WWW-asiakas)][Date Fri, 6 Apr 2007 17:37:12 +0300 (EEST)]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "Compliance Training" <[email protected]>][Date Fri, 6 Apr 2007 16:53:39 +0200 (SAST)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... / ... /[From "Harding Stephanie" <[email protected]>][Date Fri, 6 Apr 2007 14:59:58 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... /[From "Local Home Listings" <[email protected]>][Date Fri, 6 Apr 2007 07:08:19 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... /[From "HeartGuardian" <[email protected]>][Date Fri, 6 Apr 2007 01:58:14 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From " ... ... /[From "marriage" <[email protected]>][Date Fri, 6 Apr ... /[Date 1:45:09 AM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From " ... ... /[From "marriage" <[email protected]>][Date Fri, 6 Apr 2007 03:39:03 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From " ... /[From "bestlepus" <[email protected]>][Date Fri, 6 Apr 2007 ... /[Date 12:22:09 AM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From " ... /[From "bestlepus" <[email protected]>][Date Fri, 6 Apr 2007 01:44:26 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Bu .. . ... /[From playerThis" <[email protected]>][Date 6 Apr 2007 09:27:52 +0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Bu .. ... /[From "PCTV" <[email protected]>][Date Thu, 5 Apr 2007 21:08:46 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Bu ... /[From "Bryan" <[email protected]>][Date Thu, 5 Apr 2007 20:20:26 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[ ... ... /[From f ... /[From [email protected]][Date 7 Apr 2007 08:31:35 -0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[ ... ... /[From fifth no <[email protected]>][Date Mon, 9 Apr ... /[Date 8:34:44 PM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[ ... ... /[From fifth no <[email protected]>][Date Mon, 9 Apr 2007 11:30:46 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[ ... /[From "Gevalia" <[email protected]>][Date Sun, 8 Apr 2007 14:32:00 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr . ... /[From "seewell" <[email protected]>][Date Sun, 8 Apr 2007 13:59:09 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... /[From "GovtGrants" <[email protected]>][Date Sun, 8 Apr 2007 13:10:29 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr .. ... /[From "berinte.com" <[email protected]>][Date Sun, 8 Apr 2007 11:55:07 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... ... /[From "Finance America" <ErrolGrisham @adnc.com>][Date Sun, 08 Apr 2007 08:04:24 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fr ... /[From "BestHoodia" <[email protected]>][Date Sun, 8 Apr 2007 10:37:38 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From ... /[From "Doggy Steps" <[email protected]>][Date Sun, 8 Apr 2007 09:49:13 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Ph ... /[From "Blanca Bass" <[email protected]>][Date Wed, 8 Apr 1970 19:15:16 +0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Ph ... /[From "Pete Dawkins" <[email protected]>][Date Sun, 08 Apr 2007 18:40:08 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burns" <[email protected]>][Date Tue, 20 May 2003 09:52:29 ... /[Date 2:24:25 AM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burns" <[email protected]>][Date Tue, 20 May 2003 09:52:29 ... /[Date 1:07:40 AM]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... ... /[From "Do ... /[From "BB&T" <[email protected]>][Date Mon, 9 Apr 2007 18:33:51 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 ... /[From "Branch Banking and Trust" <[email protected]>][Date Tue, 10 Apr 2007 08:37:23 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... ... /[From "DustBunnies" <[email protected]>][Date Tue, 10 Apr 2007 07:37:19 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "F ... /[From "Connie P. Burris" <[email protected]>][Date Tue, 10 Apr 2007 13:32:35 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "Frankie IRebecca" <[email protected]>][Date Tue, 10 Apr 2007 12:21:07 + .. ... /html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "Frankie IRebecca" <[email protected]>][Date Tue, 10 Apr 2007 12:21:07 + ... /UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "Frankie IRebecca" <[email protected]>][Date Tue, 10 Apr 2007 12:21:07 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[Fr ... /[From "CleverClasp" <[email protected]>][Date Tue, 10 Apr 2007 05:43:37 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "gd . ... /[From " ... /[From MaupinTour <[email protected]>][Date 10 Apr 2007 04:49:23 -0400]/html Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "gd . ... /[From "Dina Hughes" <[email protected]>][Date Tue, 10 Apr 2007 15:01:10 +0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "gd ... /[From "Home Loan Center" <JodiKinsella @aginfort.com>][Date Mon, 09 Apr 2007 23:06:17 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "[email protected]" <[email protected]>][Date Tue, 10 Apr 2007 00:35:22 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... ... ... /[From "Bidz" <[email protected]>][Date Tue, 10 Apr 2007 00:54:01 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... ... /[From "Dartnell Corp." <[email protected]>][Date Mon, 9 Apr 2007 23:26:32 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... / ... /[From Lula prospect <[email protected]>][Date Mon, 9 Apr 2007 21:03:34 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... /[From "SleepyTim ... /[From [email protected]][Date Mon, 9 Apr 2007 20:44:17 -0400 (EDT)]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From ... /[From "SleepyTime" <[email protected]>][Date Mon, 9 Apr 2007 19:49:33 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From " ... /[From "Personal Care" <[email protected]>][Date Mon, 9 Apr 2007 19:08:10 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - .. ... /[From "FreeDollarStore" <[email protected]>][Date Mon, 9 Apr 2007 19:03:15 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... ... /[From "Doub ... /[From "Punch it" <[email protected]>][Date Mon, 9 Apr 2007 18:26:57 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... ... /[From "DoubledayBookClub" <[email protected]>][Date Mon, 9 Apr 2007 16:03:55 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 - ... /[From "WarrantyExtension" <[email protected]>][Date Mon, 9 Apr 2007 13:59:02 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500] ... /[From "Printer ink Blowout Sale" <[email protected]>][Date Mon, 9 Apr 2007 13:41:50 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UN ... /[From "WarrantyOptions" <[email protected]>][Date Mon, 9 Apr 2007 12:01:40 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From ... /[From "USGrants" <[email protected]>][Date Mon, 9 Apr 2007 10:28:10 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAM ... /[From "BB&T" <[email protected]>][Date Tue, 10 Apr 2007 21:35:04 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[F ... /[From "USGrants" <[email protected]>][Date Tue, 10 Apr 2007 14:51:39 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[Fro ... /[From "USGrants" <[email protected]>][Date Tue, 10 Apr 2007 12:32:13 -0400 (EDT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Ph ... /[From "Levy County EMS" <[email protected]>][Date Tue, 10 Apr 2007 12:10:28 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burn ... /[From "Rudolph Estes" <[email protected]>][Date Wed, 11 Apr 2007 01:07:17 -0800]/text Infected: Trojan-Spy.HTML.Bankfraud.ri skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNA ... /[From "Si ... /[From Abuse Team Robot <[email protected]>][Date Fri, 13 Apr 2007 15:19:34 +0800]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNA ... /[From "Simple Home Buying" <[email protected]>][Date Fri, 13 Apr 2007 02:59:38 -0400 (EDT)]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED/[From "Phil Burns" <[email protected]>][Date Tue, 20 May 2003 09:52:29 -0400]/text Infected: Email-Worm.Win32.Zhelatin.ct skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:50:15 -0500]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED/[From "Schmidt, Lee M" <[email protected]>][Date Tue, 20 May 2003 08:39:37 -0500]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text/[From "Reddick, Ryan M" <[email protected]>][Date Thu, 15 May 2003 13:46:04 -0500]/UNNAMED Infected: Email-Worm.Win32.Zhelatin.ct skipped

D:\AWK\Mail\Inbox/[From "David Ermer" <[email protected]>][Date Thu, 15 May 2003 10:31:33 -0400]/text Infected: Email-Worm.Win32.Zhelatin.ct skipped

D:\AWK\Mail\Inbox Mail Berkeley mbox: infected - 181 skipped

D:\AWK\Mail\Inbox.msf Object is locked skipped

D:\AWK\Mail\Trash.msf Object is locked skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

D:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0105873.DLL Infected: not-a-virus:Monitor.Win32.PCProtect.21 skipped

D:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\A0105874.DLL Infected: not-a-virus:Monitor.Win32.PCProtect.21 skipped

D:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1076\change.log Object is locked skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0070.BIN Infected: not-a-virus:AdTool.Win32.WhenU.a skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0071.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0072.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0073.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skipped

Z:\SusBkUp\Test\clipartfree.exe/WISE0074.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.k skipped

Z:\SusBkUp\Test\clipartfree.exe WiseSFX: infected - 11 skipped

Z:\SusBkUp\Test\clipartfree.exe WiseSFX Dropper: infected - 11 skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0084.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0084.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0084.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0087.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0087.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0087.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0088.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/WhAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/WhSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/Webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0089.BIN Infected: not-a-virus:AdWare.Win32.WebHancer skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0090.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe/WISE0091.BIN Infected: not-a-virus:Server-Proxy.Win32.MarketScore.i skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe WiseSFX: infected - 16 skipped

Z:\SusBkUp\Test\lmping-clipartfree.exe WiseSFX Dropper: infected - 16 skipped

Scan process completed.

Edited by DaDooDaidy
Link to post
Share on other sites

Delete the following files:

  • Z:\SusBkUp\Test\clipartfree.exe
    Z:\SusBkUp\Test\lmping-clipartfree.exe

Since you would like to save the emails, I recommend that you burn them to a CD in order to reduce the risk of infection.

Let's make a new restore point and clear the others:

  • Go - Start>Programmes>Accessories>System Tools>System Restore>Create a New Restore point.
    Go - Start>Programmes>Accessories>System Tools>Disc Cleanup>"More Options" Tab>Remove All But Most Recent Point. Please repeat this step for all drives listed when you fisrt open Disc Cleanup.

Reboot your computer.

If you would please rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working. :)

-Ryan

Link to post
Share on other sites

I deleted the two files.

I cannot get to System Restore after Programs in the Start Menu, even if I switch it to classic view.

I used Windows Explorer and found it here:

C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools

I get the following message...

System Restore is not able to protect your computer. Please restart your computer, and then run System Restore again.

I moved the old email from the previous version to put on CD later. Or I might decide to delete that folder.

I think I need to continue saving what I need to from the current folder and delete the rest.

Link to post
Share on other sites

Yes, the tab is enabled. When I check the box for 'turn off System Restore on all drives', a confirmation message says all existing restore points will be deleted and I will not be able to track or undo changes to the computer. I clicked Yes and it says it encountered an error trying to enable/disable one or more drives (C and D). Please restart machine and try again. Now the box is unchecked.

It looks like I'm unable to check the box to turn if off, reboot, then check the box again.

P.S. I'm still getting an option to update system and shutdown when the computer is turned off. Since I don't know what the updates are and I want to make sure the computer will turn on again. I keep changing the option to shutdown only.

Edited by DaDooDaidy
Link to post
Share on other sites

The computer loads up faster than it used to since I did the virus scans. I still have these things.

There is no list after All Programs in the start menu, there is no recycle bin and the modem is not functioning. If I type an incorrect url in the Mozilla Firefox browser, it will seem to hang with a connection dialog and then nothing works until the browser is closed and started again. When I print a document, I get a Windows Installer dialog that I have to cancel and close, but it still prints.

When I lose the connection dialog without closing the browser, it still seems to work okay. Although yesterday some pages were not showing up and the images disappeared. Then I cleared all private data and it was okay. I'm using Mozilla Firefox.

Thanks for telling me about the updates and shutdown message.

There are a couple of other messages that I get from SpyBot. Both from Session Manager:Value Deleted. First is BootExecute- old data: autocheck autochk * and the second is ExcludeFromKnownDlls. I'm not sure what these are yet, so I deny the changes without using the 'remember this decision' option until I know for sure.

I still get a blank dialog box with something that looks like brackets in the upper left corner when the computer boots up, but doesn't happen when computer is restarted. This happens before the normal user login and password. I can't close the blank box without hitting the button.

Link to post
Share on other sites

This post should help with the items SpyBot is saying: http://forums.spybot.info/showpost.php?p=6...amp;postcount=3

The rest of your issues do not appear to be malware related, and should be posted about in the Windows forum.

Congratulations, your log is clean :thumbsup:

For information on how to protect yourself in the future, read Infection Prevention

Do you have any other questions or concerns? This thread will be left open for a few more days, so feel free to ask.

-Ryan

Link to post
Share on other sites

Thank you very much for your help and the links. I did those steps with the Tea Timer, but it didn't help for some reason. You're right the other problems are Windows related. I had to reinstall Windows XP. The problems I mentioned have gone away. I still have all my files including the applications, but need to reinstall everything to synchronize the computer.

This is a great site. I would love to learn more or maybe take a class later.

Link to post
Share on other sites
  • 2 weeks later...

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.