Virus trojan virtumonde

am013 · le 31 juillet 2007

Bonjour a tous...

Malgre plusieurs tentatives je n'arrive toujours pas a eliminer ce virus.

Je ne connais pas gd chose

Qqu'un peut jetter un oeil a mes derniers rapports ds mon article precedent "Help lectures rapports" svp et juste mme dire si il existe une solution..

Merci d'avance.

am013 · le 31 juillet 2007

Personne ne peut m'aider??

Lien Rag · le 31 juillet 2007

Bonjour

dans un premier temps merci de poster un rapport Hijack selon

Télécharge hijack this, renomme le scanner (si c'est pas fait renomme le avant tout scan) et mets-le dans un dossier nommé hijackthis dans tes program files ! (C:\Program Files\HijackThis)

Clique alors sur "Do a system scan and save a logfile"

Le scan se fait très rapidement, puis un bloc-note apparaît

(le "logfile")

Dans ce bloc-note, va dans "Edition", puis "Selectionner Tout",

le texte est alors séléctionné, retourne dans "Edition" toujours

en laissant le texte séléctionné, et clique sur copier.

Colle le contenu ici dans ta prochaine réponse !

y@nnik · le 31 juillet 2007

Bonjour.

À mon avis, c'est inutile...

http://forum.zebulon.fr/index.php?showtopic=126907

am013 · le 31 juillet 2007

Bonsoir Lien Rag,

Voici mon tapport hijackThis...

Merci a toi:)

Logfile of HijackThis v1.99.1

Scan saved at 19:34:45, on 31/07/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\Softwin\BitDefender9\bdoesrv.exe

C:\progra~1\softwin\bitdef~1\bdswitch.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Logitech\SetPoint\KEM.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\Java\jre1.5.0_08\bin\jucheck.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Softwin\BitDefender9\vsserv.exe

c:\progra~1\softwin\bitdef~1\bdmcon.exe

C:\Documents and Settings\Admin\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {07E28EC0-23EA-4541-84E1-D4EFE6E2CB9C} - C:\WINDOWS\system32\vturo.dll

O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll (file missing)

O2 - BHO: (no name) - {1CF8C455-6664-4BEE-BBB1-238F26D90EBF} - C:\WINDOWS\system32\geebc.dll (file missing)

O2 - BHO: (no name) - {1FB63E52-4D6E-48C1-A08F-F630FE50F337} - C:\WINDOWS\system32\jkkkhhf.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {92656D96-3403-4246-80A9-F589A4BA5509} - C:\WINDOWS\system32\ddcyw.dll (file missing)

O2 - BHO: (no name) - {B61D26B7-E69D-431E-95A9-2BCA55D1FDAA} - C:\WINDOWS\system32\ssttu.dll (file missing)

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [bDMCon] c:\progra~1\softwin\bitdef~1\bdmcon.exe

O4 - HKLM\..\Run: [bDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"

O4 - HKLM\..\Run: [bDSwitchAgent] "c:\progra~1\softwin\bitdef~1\bdswitch.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?921f74258d18415387940328e3e1ba25

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?921f74258d18415387940328e3e1ba25

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: jkkkhhf - C:\WINDOWS\SYSTEM32\jkkkhhf.dll

O20 - Winlogon Notify: tuvvutq - C:\WINDOWS\SYSTEM32\tuvvutq.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)

O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)

O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Lien Rag · le 31 juillet 2007

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

Double-clique VundoFix.exe afin de le lancer.

Clique sur le bouton "Scan for Vundo"

Lorsque le scan est complété, clique sur le bouton Remove Vundo.

Une invite te demandera si tu veux supprimer les fichiers, clique YES

Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.

Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown"); clique OK

Démarre ton PC à nouveau.

Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

Télécharge VirtumundoBegone sur le bureau:

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.

Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau

dans ta prochaine réponse avec un nouveau rapport HijackThis.

Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu.

am013 · le 31 juillet 2007

Voila deja le rapport vundofix;

VundoFix V6.5.6

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Scan started at 17:29:46 27/07/2007

Listing files found while scanning....

C:\windows\system32\apeflwcb.ini

C:\windows\system32\bcwlfepa.dll

C:\windows\system32\bhsvgdfl.ini

C:\windows\system32\dmpvuice.dll

C:\windows\system32\eapddxuj.ini

C:\windows\system32\eciuvpmd.ini

C:\windows\system32\eephbtht.dll

C:\WINDOWS\system32\efcdaxx.dll

C:\windows\system32\foqbdwos.dll

C:\windows\system32\jclacigr.ini

C:\windows\system32\juxddpae.dll

C:\windows\system32\laoukffn.dll

C:\windows\system32\lfdgvshb.dll

C:\windows\system32\luvweydv.dll

C:\windows\system32\nffkuoal.ini

C:\windows\system32\rgicalcj.dll

C:\windows\system32\rraerisw.dll

C:\windows\system32\sowdbqof.ini

C:\windows\system32\thtbhpee.ini

C:\windows\system32\vdyewvul.ini

C:\WINDOWS\system32\vturo.dll

C:\windows\system32\wsirearr.ini

Beginning removal...

Attempting to delete C:\windows\system32\apeflwcb.ini

C:\windows\system32\apeflwcb.ini Has been deleted!

Attempting to delete C:\windows\system32\bcwlfepa.dll

C:\windows\system32\bcwlfepa.dll Has been deleted!

Attempting to delete C:\windows\system32\bhsvgdfl.ini

C:\windows\system32\bhsvgdfl.ini Has been deleted!

Attempting to delete C:\windows\system32\dmpvuice.dll

C:\windows\system32\dmpvuice.dll Has been deleted!

Attempting to delete C:\windows\system32\eapddxuj.ini

C:\windows\system32\eapddxuj.ini Has been deleted!

Attempting to delete C:\windows\system32\eciuvpmd.ini

C:\windows\system32\eciuvpmd.ini Has been deleted!

Attempting to delete C:\windows\system32\eephbtht.dll

C:\windows\system32\eephbtht.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcdaxx.dll

C:\WINDOWS\system32\efcdaxx.dll Could not be deleted.

Attempting to delete C:\windows\system32\foqbdwos.dll

C:\windows\system32\foqbdwos.dll Has been deleted!

Attempting to delete C:\windows\system32\jclacigr.ini

C:\windows\system32\jclacigr.ini Has been deleted!

Attempting to delete C:\windows\system32\juxddpae.dll

C:\windows\system32\juxddpae.dll Has been deleted!

Attempting to delete C:\windows\system32\laoukffn.dll

C:\windows\system32\laoukffn.dll Has been deleted!

Attempting to delete C:\windows\system32\lfdgvshb.dll

C:\windows\system32\lfdgvshb.dll Has been deleted!

Attempting to delete C:\windows\system32\luvweydv.dll

C:\windows\system32\luvweydv.dll Has been deleted!

Attempting to delete C:\windows\system32\nffkuoal.ini

C:\windows\system32\nffkuoal.ini Has been deleted!

Attempting to delete C:\windows\system32\rgicalcj.dll

C:\windows\system32\rgicalcj.dll Has been deleted!

Attempting to delete C:\windows\system32\rraerisw.dll

C:\windows\system32\rraerisw.dll Has been deleted!

Attempting to delete C:\windows\system32\sowdbqof.ini

C:\windows\system32\sowdbqof.ini Has been deleted!

Attempting to delete C:\windows\system32\thtbhpee.ini

C:\windows\system32\thtbhpee.ini Has been deleted!

Attempting to delete C:\windows\system32\vdyewvul.ini

C:\windows\system32\vdyewvul.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\vturo.dll

C:\WINDOWS\system32\vturo.dll Could not be deleted.

Attempting to delete C:\windows\system32\wsirearr.ini

C:\windows\system32\wsirearr.ini Has been deleted!

Performing Repairs to the registry.

Done!

VundoFix V6.5.6

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Scan started at 23:15:00 29/07/2007

Listing files found while scanning....

C:\WINDOWS\system32\cbeeg.bak1

C:\WINDOWS\system32\cbeeg.bak2

C:\WINDOWS\system32\cbeeg.ini

C:\WINDOWS\system32\geebc.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\cbeeg.bak1

C:\WINDOWS\system32\cbeeg.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbeeg.bak2

C:\WINDOWS\system32\cbeeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbeeg.ini

C:\WINDOWS\system32\cbeeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\geebc.dll

C:\WINDOWS\system32\geebc.dll Has been deleted!

Performing Repairs to the registry.

Done!

VundoFix V6.5.6

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Scan started at 00:47:01 30/07/2007

Listing files found while scanning....

C:\WINDOWS\system32\ddcyw.dll

C:\WINDOWS\system32\wycdd.bak1

C:\WINDOWS\system32\wycdd.ini

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ddcyw.dll

C:\WINDOWS\system32\ddcyw.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wycdd.bak1

C:\WINDOWS\system32\wycdd.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\wycdd.ini

C:\WINDOWS\system32\wycdd.ini Has been deleted!

Performing Repairs to the registry.

Done!

VundoFix V6.5.6

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Scan started at 19:33:47 30/07/2007

Listing files found while scanning....

C:\WINDOWS\system32\ssttu.dll

C:\WINDOWS\system32\uttss.bak1

C:\WINDOWS\system32\uttss.bak2

C:\WINDOWS\system32\uttss.ini

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ssttu.dll

C:\WINDOWS\system32\ssttu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\uttss.bak1

C:\WINDOWS\system32\uttss.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\uttss.bak2

C:\WINDOWS\system32\uttss.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\uttss.ini

C:\WINDOWS\system32\uttss.ini Has been deleted!

Performing Repairs to the registry.

Done!

VundoFix V6.5.6

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.8

Old versions of java are exploitable and should be removed.

Scan started at 20:08:37 31/07/2007

Listing files found while scanning....

No infected files were found.

Beginning removal...

am013 · le 31 juillet 2007

Voici le rapport virtumundo;

[07/31/2007, 20:18:04] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Admin\Bureau\VirtumundoBeGone.exe" )

[07/31/2007, 20:18:07] - Detected System Information:

[07/31/2007, 20:18:07] - Windows Version: 5.1.2600, Service Pack 2

[07/31/2007, 20:18:07] - Current Username: Admin (Admin)

[07/31/2007, 20:18:07] - Windows is in NORMAL mode.

[07/31/2007, 20:18:07] - Searching for Browser Helper Objects:

[07/31/2007, 20:18:07] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} (Yahoo! Toolbar Helper)

[07/31/2007, 20:18:07] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)

[07/31/2007, 20:18:07] - BHO 3: {07E28EC0-23EA-4541-84E1-D4EFE6E2CB9C} ()

[07/31/2007, 20:18:07] - WARNING: BHO has no default name. Checking for Winlogon reference.

[07/31/2007, 20:18:07] - Checking for HKLM\...\Winlogon\Notify\vturo

[07/31/2007, 20:18:07] - Key not found: HKLM\...\Winlogon\Notify\vturo, continuing.

[07/31/2007, 20:18:07] - BHO 4: {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE Class)

[07/31/2007, 20:18:07] - BHO 5: {1CF8C455-6664-4BEE-BBB1-238F26D90EBF} ()

[07/31/2007, 20:18:07] - WARNING: BHO has no default name. Checking for Winlogon reference.

[07/31/2007, 20:18:07] - Checking for HKLM\...\Winlogon\Notify\geebc

[07/31/2007, 20:18:07] - Key not found: HKLM\...\Winlogon\Notify\geebc, continuing.

[07/31/2007, 20:18:07] - BHO 6: {1FB63E52-4D6E-48C1-A08F-F630FE50F337} ()

[07/31/2007, 20:18:07] - WARNING: BHO has no default name. Checking for Winlogon reference.

[07/31/2007, 20:18:07] - Checking for HKLM\...\Winlogon\Notify\jkkkhhf

[07/31/2007, 20:18:07] - Found: HKLM\...\Winlogon\Notify\jkkkhhf - This is probably Virtumundo.

[07/31/2007, 20:18:07] - Assigning {1FB63E52-4D6E-48C1-A08F-F630FE50F337} MSEvents Object

[07/31/2007, 20:18:07] - BHO list has been changed! Starting over...