win32Vundo@dll[Trj]

Hi, I have the above, Avast tells me to move to chest , which I do every time it finds it. Can you look through my log and let me know how to get rid of it. Many thanks.
I have run A2, Spybot, AVG Anit-spyware and NoLop.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:20:10, on 6/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Internode\mum.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Qlock\qlock.exe
C:\Program Files\Shrink Pic\shrink_pic.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0CCB7673-04D5-4DE7-916B-384A3642BAF4} - C:\WINDOWS\system32\efcAPJbA.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [InternodeUsage] C:\PROGRA~1\Internode\mum.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: ATO.lnk = E:\OnlineServicesSetup.exe
O4 - Startup: qlock.lnk = C:\Program Files\Qlock\qlock.exe
O4 - Startup: Shrink Pic.lnk = C:\Program Files\Shrink Pic\shrink_pic.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208426921243
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: schmap-help - (no CLSID) - (no file)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: efcAPJbA - efcAPJbA.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10416 bytes

welcome to malwareremoval forums

My name is Dan, and I will be helping you to remove any infection(s) that you may have.

Please note! that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

Please observe these rules while we work:

• Perform all actions in the order given.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Stick with it till you're given the all clear.
• REMEMBER, ABSENCE OF SYMPTOMS DOES NOT MEAN THE INFECTION IS ALL GONE.

If you can do these things, everything should go smoothly.

• Please note you'll need to have Administrator priviledges to perform the fixes. (XP accounts are Administrator by default)
• Please let me know if you are using a computer with multiple accounts, as this can affect the instructions given.

Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed.


It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

I'm presently looking over your log and hope not to be too long.
Will be back with you as soon as I can.
Thanks dan

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix


Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
   
   
2. Click Yes to allow ComboFix to continue scanning for malware.
   

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New HijackThis log.

Thanks for getting back to me, I will install and post logs asap. I have no other accounts on the PC. Only me!
I have looked at the Microsoft site it dose not have a d/l for sp3. I have the disk. Do I need to d/l or not?

Thanks

I have the disk. Do I need to d/l or not?

No, you should be ok, having the disc also.

Logs as requested.......
ComboFix 08-06-01.6 - Dave Garner 2008-06-02 17:44:21.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.547 [GMT 9.5:30]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\inst.exe
C:\Documents and Settings\Dave Garner\Application Data\inst.exe

.
((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.

2008-05-31 11:56 . 2008-05-31 12:07 <DIR> d-------- C:\My Music
2008-05-31 11:50 . 2008-05-31 12:01 <DIR> d-------- C:\Program Files\MP3 Wav Editor
2008-05-28 20:25 . 2008-05-28 20:25 <DIR> d-------- C:\VundoFix Backups
2008-05-26 19:24 . 2008-05-26 19:24 <DIR> d-------- C:\DriveKey
2008-05-26 15:40 . 2008-05-26 15:40 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-05-24 13:25 . 2008-05-24 13:25 <DIR> d-------- C:\Documents and Settings\Dave Garner\Application Data\Nokia Multimedia Player
2008-05-24 13:15 . 2008-03-20 19:39 26,112 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-05-24 13:15 . 2008-03-20 19:39 26,112 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2008-05-24 13:15 . 2008-05-24 13:15 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-24 13:15 . 2008-05-24 13:15 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-05-24 10:26 . 2008-05-24 10:26 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-05-24 10:24 . 2008-05-24 10:24 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-05-24 10:24 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-05-24 10:23 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-05-24 10:23 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-05-24 10:23 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-05-24 10:23 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-05-24 10:23 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-05-24 10:23 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-05-20 15:27 . 2008-05-20 15:27 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-05-18 17:25 . 2008-05-18 17:25 <DIR> d-------- C:\Documents and Settings\Dave Garner\Application Data\vlc
2008-05-18 16:27 . 2008-05-18 16:27 <DIR> d-------- C:\Program Files\VideoLAN
2008-05-18 15:43 . 2008-05-18 15:43 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-05-18 15:42 . 2008-05-18 15:42 <DIR> d-------- C:\Documents and Settings\Dave Garner\Application Data\DAEMON Tools
2008-05-18 15:32 . 2008-03-01 22:36 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-05-18 15:32 . 2007-04-17 19:02 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-05-18 15:32 . 2007-03-08 14:40 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-05-18 15:32 . 2008-03-01 22:36 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-05-18 15:32 . 2008-03-01 22:36 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-05-18 15:32 . 2008-03-01 22:36 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-05-18 15:32 . 2008-03-01 22:36 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-05-18 15:32 . 2008-03-01 22:36 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-05-18 15:32 . 2008-02-22 19:30 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-05-17 19:51 . 2008-06-01 21:40 <DIR> d-------- C:\Program Files\PeerGuardian2
2008-05-16 19:45 . 2008-05-16 19:45 <DIR> d-------- C:\Program Files\Sun
2008-05-16 13:29 . 2008-05-16 13:29 <DIR> d-------- C:\Documents and Settings\Dave Garner\WINDOWS
2008-05-13 19:53 . 2008-05-13 19:55 <DIR> d-------- C:\Program Files\QuickTime
2008-05-12 17:57 . 2008-05-12 17:58 <DIR> d-------- C:\Program Files\Audio Identifier
2008-05-11 19:51 . 2008-05-12 17:54 <DIR> d-------- C:\Documents and Settings\Dave Garner\Application Data\DivX
2008-05-11 19:50 . 2008-03-22 06:00 129,784 --a------ C:\WINDOWS\system32\pxafs.dll
2008-05-11 19:50 . 2008-03-22 06:00 120,056 --a------ C:\WINDOWS\system32\pxcpyi64.exe
2008-05-11 19:50 . 2008-03-22 06:00 118,520 --a------ C:\WINDOWS\system32\pxinsi64.exe
2008-05-11 19:49 . 2008-05-11 19:50 <DIR> d-------- C:\Program Files\DivX
2008-05-09 15:58 . 2008-05-10 15:36 421 --a------ C:\WINDOWS\PCPHOTO.INI
2008-05-05 20:12 . 2008-05-05 20:12 <DIR> d-------- C:\Program Files\filehippo.com
2008-05-03 07:29 . 2008-05-03 07:30 <DIR> d-------- C:\Program Files\FLAC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 07:54 3,932 ----a-w C:\Documents and Settings\Dave Garner\Application Data\LMLayout.dat
2008-06-02 07:54 268 ----a-w C:\Documents and Settings\Dave Garner\Application Data\LMCPaper.dat
2008-06-02 07:35 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-01 12:09 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Azureus
2008-05-31 02:53 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-05-31 02:53 --------- d-----w C:\Program Files\SpywareBlaster
2008-05-28 10:52 --------- d-----w C:\Program Files\Java
2008-05-26 09:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-26 08:38 --------- d-----w C:\Program Files\a-squared Free
2008-05-26 05:54 1,060 ----a-w C:\delete.bat
2008-05-24 11:42 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\shrink_pic
2008-05-24 03:53 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Nokia
2008-05-24 00:56 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-24 00:52 --------- d-----w C:\Program Files\Nokia
2008-05-24 00:51 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations
2008-05-18 05:56 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\1Click DVD Copy Pro
2008-05-18 05:17 --------- d-----w C:\Program Files\FinePixViewer
2008-05-13 21:55 --------- d-----w C:\Program Files\Apple Software Update
2008-05-05 09:35 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Internode
2008-05-03 06:28 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Apple Computer
2008-05-01 06:05 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\PC Suite
2008-05-01 05:36 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-05-01 05:36 47,360 ----a-w C:\Documents and Settings\Dave Garner\Application Data\pcouffin.sys
2008-05-01 05:36 --------- d-----w C:\Program Files\LG Software Innovations
2008-05-01 05:36 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Vso
2008-04-29 10:32 --------- d-----w C:\Program Files\Shrink Pic
2008-04-24 08:12 --------- d-----w C:\Program Files\LimeWire
2008-04-24 08:12 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\LimeWire
2008-04-24 07:47 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\WinPatrol
2008-04-24 07:45 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-04-24 07:40 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\SUPERAntiSpyware.com
2008-04-23 07:28 --------- d-----w C:\Program Files\Internode
2008-04-21 11:56 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\FLEXnet
2008-04-21 11:49 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-21 11:49 --------- d-----w C:\Program Files\Bonjour
2008-04-21 11:32 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-04-20 06:13 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\FUJIFILM
2008-04-20 06:02 --------- d-----w C:\Program Files\PIXELA
2008-04-20 05:57 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\InstallShield
2008-04-20 05:56 --------- d-----w C:\Program Files\REGSHAVE
2008-04-17 10:28 --------- d-----w C:\Program Files\CSI
2008-04-17 10:16 --------- d-----w C:\Program Files\ECIClientV5
2008-04-17 09:36 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-04-17 08:12 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\ImgBurn
2008-04-17 07:15 --------- d-----w C:\Program Files\Azureus
2008-04-17 06:57 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\DVD Shrink
2008-04-16 06:51 --------- d-----w C:\Program Files\Gogo MP3 To CD Burner
2008-04-16 06:49 --------- d-----w C:\Program Files\GoGo CD Ripper
2008-04-15 10:31 --------- d-----w C:\Program Files\Qlock
2008-04-15 08:04 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Serif
2008-04-14 09:54 --------- d-----w C:\Program Files\PCI Audio Applications
2008-04-14 09:36 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\wsInspector
2008-04-14 06:43 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Talkback
2008-04-14 06:42 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Thunderbird
2008-04-14 06:38 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Logitech
2008-04-14 06:38 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Comodo
2008-04-14 05:39 --------- d-----w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\Azureus
2008-04-14 04:32 --------- d-----w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\SiteAdvisor
2008-04-04 06:44 --------- d-----w C:\Program Files\Vidomi
2008-03-31 21:25 831,488 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 21:25 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-30 05:44 3,932 -c--a-w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\LMLayout.dat
2008-03-30 05:44 268 -c--a-w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\LMCPaper.dat
2008-03-29 06:22 2,572 ----a-w C:\WINDOWS\WINDVDBOOTRECDOE.sys
2008-03-29 03:24 47,360 ----a-w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\pcouffin.sys
2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-20 16:32 1,295,938 ----a-r C:\WINDOWS\SET10A.tmp
2008-03-20 16:25 1,088,979 ----a-r C:\WINDOWS\SET10B.tmp
2008-03-20 16:24 16,674 ----a-r C:\WINDOWS\SET117.tmp
2008-03-20 16:07 23,552 ----a-w C:\WINDOWS\system32\wdmaud.drv
2008-03-20 16:06 74,752 ----a-w C:\WINDOWS\system32\storprop.dll
2008-03-20 16:06 53,760 ----a-w C:\WINDOWS\system32\vfwwdm32.dll
2008-03-20 16:06 4,096 ----a-w C:\WINDOWS\system32\ksuser.dll
2008-03-20 16:06 159,232 ----a-w C:\WINDOWS\system32\ptpusd.dll
2008-03-20 14:49 1,804 ----a-w C:\WINDOWS\system32\Dcache.bin
2008-03-20 14:45 74,240 ----a-w C:\WINDOWS\system32\usbui.dll
2008-03-20 14:45 52,736 ----a-w C:\WINDOWS\system32\wzcsapi.dll
2008-03-20 14:45 52,224 ----a-w C:\WINDOWS\system32\dmutil.dll
2008-03-20 14:45 483,840 ----a-w C:\WINDOWS\system32\wzcsvc.dll
2008-03-20 14:45 47,616 ----a-w C:\WINDOWS\system32\iyuv_32.dll
2008-03-20 14:45 47,104 ----a-w C:\WINDOWS\system32\cnbjmon.dll
2008-03-20 14:45 35,328 ----a-w C:\WINDOWS\system32\pid.dll
2008-03-20 14:45 294,912 ----a-w C:\WINDOWS\system32\msh263.drv
2008-03-20 14:45 20,992 ----a-w C:\WINDOWS\system32\hid.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CCB7673-04D5-4DE7-916B-384A3642BAF4}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-03-21 00:06 15360]
"InternodeUsage"="C:\PROGRA~1\Internode\mum.exe" [2008-03-01 15:24 1334272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 08:49 79224]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-02-11 07:02 1115728]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-01-27 15:08 316728]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 01:17 55824 C:\WINDOWS\KHALMNPR.Exe]
"BOC-425"="C:\PROGRA~1\Comodo\CBOClean\BOC425.exe" [2007-08-08 19:49 338432]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 01:17 55824 C:\WINDOWS\KHALMNPR.Exe]
"dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2008-03-01 14:49 826880]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-24 06:48 443968]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [4/20/2008 3:27:43 PM 303104]
Lexmark X125 Settings Utility.lnk - C:\Program Files\Lexmark X125\LEX125SU.exe [2/5/2007 10:21:00 AM 1810432]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [10/30/2007 3:57:25 PM 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2/16/2008 6:08:47 AM 789008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcAPJbA]
efcAPJbA.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2008-01-09 11:30 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
"vidc.xvid"= xvid.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\CTFMON.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\LMpdpsrv.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\Raven\\SOF PLATINUM\\SoF.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 08:50]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 08:46]
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-03-20 19:37]
S2 Ca533av;Mega DV(Video);C:\WINDOWS\system32\Drivers\Ca533av.sys [2002-08-07 18:33]
S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
S3 upperdev;upperdev;C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39]
S3 USBCamera;DSC Still Image Capture (CA533A);C:\WINDOWS\system32\Drivers\Bulk533.sys [2002-07-25 11:19]
S3 UsbserFilt;UsbserFilt;C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 10:10:54 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 17:48:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


folder error: C:\DOCUME~1\Dave Garner\Local Settings\Temp\

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-02 17:52:12
ComboFix-quarantined-files.txt 2008-06-02 08:22:08

Pre-Run: 3,744,006,144 bytes free
Post-Run: 3,770,081,280 bytes free

261 --- E O F --- 2008-05-28 07:09:30



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:27:31, on 6/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Internode\mum.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Qlock\qlock.exe
C:\Program Files\Shrink Pic\shrink_pic.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0CCB7673-04D5-4DE7-916B-384A3642BAF4} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [InternodeUsage] C:\PROGRA~1\Internode\mum.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: ATO.lnk = E:\OnlineServicesSetup.exe
O4 - Startup: qlock.lnk = C:\Program Files\Qlock\qlock.exe
O4 - Startup: Shrink Pic.lnk = C:\Program Files\Shrink Pic\shrink_pic.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208426921243
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: schmap-help - (no CLSID) - (no file)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: efcAPJbA - efcAPJbA.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10148 bytes

Submit a File For Analysis
We need to have the files below Scanned by Uploading them/it to Jotti

Please visit Jotti
Copy/paste the the following file path into the window
C:\WINDOWS\SET10A.tmp

Click Submit/Send File
Please post back, to let me know the results.

Please do the same for the following file
C:\WINDOWS\SET10B.tmp
C:\WINDOWS\SET117.tmp


If Jotti is too busy please try Virustotal

1. Close any open browsers.

2. Open notepad and copy/paste the text in the codebox below into it:

File::

C:\delete.bat

Folder::

C:\VundoFix Backups

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CCB7673-04D5-4DE7-916B-384A3642BAF4}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcAPJbA]

    

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall



: Malwarebytes' Anti-Malware :

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\\Documents and Settings\\Username\\Application Data\\Malwarebytes\\Malwarebytes' Anti-Malware\\Logs\\mbam-log-date (time).txt

post combo report
Jotti's reports
malwarebytes report
fresh HJT log

Here goes......
Scan taken on 02 Jun 2008 10:27:16 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing


File: SET10B.tmp
Status:
OK
MD5: 5aa3864ccc1ef896fe4d7f6728872f62
Packers detected:
-
Scanner results
Scan taken on 02 Jun 2008 10:31:21 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

File: SET117.tmp
Status:
OK
MD5: 8eb34790943721c24ee11ae54ab3b989
Packers detected:
-
Scanner results
Scan taken on 02 Jun 2008 10:34:14 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

ComboFix 08-06-01.6 - Dave Garner 2008-06-02 20:08:58.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.579 [GMT 9.5:30]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dave Garner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\delete.bat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\delete.bat
C:\VundoFix Backups

.
((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.

2008-05-31 11:56 . 2008-05-31 12:07 <DIR> d-------- C:\My Music
2008-05-31 11:50 . 2008-05-31 12:01 <DIR> d-------- C:\Program Files\MP3 Wav Editor
2008-05-26 19:24 . 2008-05-26 19:24 <DIR> d-------- C:\DriveKey
2008-05-26 15:40 . 2008-05-26 15:40 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-05-24 13:25 . 2008-05-24 13:25 <DIR> d-------- C:\Documents and Settings\Dave Garner\Application Data\Nokia Multimedia Player
2008-05-24 13:15 . 2008-03-20 19:39 26,112 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-05-24 13:15 . 2008-03-20 19:39 26,112 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2008-05-24 13:15 . 2008-05-24 13:15 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-24 13:15 . 2008-05-24 13:15 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-05-24 10:26 . 2008-05-24 10:26 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-05-24 10:24 . 2008-05-24 10:24 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-05-24 10:24 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-05-24 10:23 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-05-24 10:23 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-05-24 10:23 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-05-24 10:23 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-05-24 10:23 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-05-24 10:23 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-05-20 15:27 . 2008-05-20 15:27 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-05-18 17:25 . 2008-05-18 17:25 <DIR> d-------- C:\Documents and Settings\Dave Garner\Application Data\vlc
2008-05-18 16:27 . 2008-05-18 16:27 <DIR> d-------- C:\Program Files\VideoLAN
2008-05-18 15:43 . 2008-05-18 15:43 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-05-18 15:42 . 2008-05-18 15:42 <DIR> d-------- C:\Documents and Settings\Dave Garner\Application Data\DAEMON Tools
2008-05-18 15:32 . 2008-03-01 22:36 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-05-18 15:32 . 2007-04-17 19:02 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-05-18 15:32 . 2007-03-08 14:40 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-05-18 15:32 . 2008-03-01 22:36 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-05-18 15:32 . 2008-03-01 22:36 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-05-18 15:32 . 2008-03-01 22:36 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-05-18 15:32 . 2008-03-01 22:36 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-05-18 15:32 . 2008-03-01 22:36 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-05-18 15:32 . 2008-02-22 19:30 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-05-17 19:51 . 2008-06-01 21:40 <DIR> d-------- C:\Program Files\PeerGuardian2
2008-05-16 19:45 . 2008-05-16 19:45 <DIR> d-------- C:\Program Files\Sun
2008-05-16 13:29 . 2008-05-16 13:29 <DIR> d-------- C:\Documents and Settings\Dave Garner\WINDOWS
2008-05-13 19:53 . 2008-05-13 19:55 <DIR> d-------- C:\Program Files\QuickTime
2008-05-12 17:57 . 2008-05-12 17:58 <DIR> d-------- C:\Program Files\Audio Identifier
2008-05-11 19:51 . 2008-05-12 17:54 <DIR> d-------- C:\Documents and Settings\Dave Garner\Application Data\DivX
2008-05-11 19:50 . 2008-03-22 06:00 129,784 --a------ C:\WINDOWS\system32\pxafs.dll
2008-05-11 19:50 . 2008-03-22 06:00 120,056 --a------ C:\WINDOWS\system32\pxcpyi64.exe
2008-05-11 19:50 . 2008-03-22 06:00 118,520 --a------ C:\WINDOWS\system32\pxinsi64.exe
2008-05-11 19:49 . 2008-05-11 19:50 <DIR> d-------- C:\Program Files\DivX
2008-05-09 15:58 . 2008-05-10 15:36 421 --a------ C:\WINDOWS\PCPHOTO.INI
2008-05-05 20:12 . 2008-05-05 20:12 <DIR> d-------- C:\Program Files\filehippo.com
2008-05-03 07:29 . 2008-05-03 07:30 <DIR> d-------- C:\Program Files\FLAC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 08:59 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-02 07:54 3,932 ----a-w C:\Documents and Settings\Dave Garner\Application Data\LMLayout.dat
2008-06-02 07:54 268 ----a-w C:\Documents and Settings\Dave Garner\Application Data\LMCPaper.dat
2008-06-01 12:09 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Azureus
2008-05-31 02:53 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-05-31 02:53 --------- d-----w C:\Program Files\SpywareBlaster
2008-05-28 10:52 --------- d-----w C:\Program Files\Java
2008-05-26 09:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-26 08:38 --------- d-----w C:\Program Files\a-squared Free
2008-05-24 11:42 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\shrink_pic
2008-05-24 03:53 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Nokia
2008-05-24 00:56 --------- d-----w C:\Program Files\Common Files\Nokia
2008-05-24 00:52 --------- d-----w C:\Program Files\Nokia
2008-05-24 00:51 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations
2008-05-18 05:56 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\1Click DVD Copy Pro
2008-05-18 05:17 --------- d-----w C:\Program Files\FinePixViewer
2008-05-13 21:55 --------- d-----w C:\Program Files\Apple Software Update
2008-05-05 09:35 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Internode
2008-05-03 06:28 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Apple Computer
2008-05-01 06:05 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\PC Suite
2008-05-01 05:36 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-05-01 05:36 47,360 ----a-w C:\Documents and Settings\Dave Garner\Application Data\pcouffin.sys
2008-05-01 05:36 --------- d-----w C:\Program Files\LG Software Innovations
2008-05-01 05:36 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Vso
2008-04-29 10:32 --------- d-----w C:\Program Files\Shrink Pic
2008-04-24 08:12 --------- d-----w C:\Program Files\LimeWire
2008-04-24 08:12 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\LimeWire
2008-04-24 07:47 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\WinPatrol
2008-04-24 07:45 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-04-24 07:40 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\SUPERAntiSpyware.com
2008-04-23 07:28 --------- d-----w C:\Program Files\Internode
2008-04-21 11:56 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\FLEXnet
2008-04-21 11:49 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-21 11:49 --------- d-----w C:\Program Files\Bonjour
2008-04-21 11:32 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-04-20 06:13 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\FUJIFILM
2008-04-20 06:02 --------- d-----w C:\Program Files\PIXELA
2008-04-20 05:57 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\InstallShield
2008-04-20 05:56 --------- d-----w C:\Program Files\REGSHAVE
2008-04-17 10:28 --------- d-----w C:\Program Files\CSI
2008-04-17 10:16 --------- d-----w C:\Program Files\ECIClientV5
2008-04-17 09:36 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-04-17 08:12 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\ImgBurn
2008-04-17 07:15 --------- d-----w C:\Program Files\Azureus
2008-04-17 06:57 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\DVD Shrink
2008-04-16 06:51 --------- d-----w C:\Program Files\Gogo MP3 To CD Burner
2008-04-16 06:49 --------- d-----w C:\Program Files\GoGo CD Ripper
2008-04-15 10:31 --------- d-----w C:\Program Files\Qlock
2008-04-15 08:04 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Serif
2008-04-14 09:54 --------- d-----w C:\Program Files\PCI Audio Applications
2008-04-14 09:36 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\wsInspector
2008-04-14 06:43 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Talkback
2008-04-14 06:42 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Thunderbird
2008-04-14 06:38 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Logitech
2008-04-14 06:38 --------- d-----w C:\Documents and Settings\Dave Garner\Application Data\Comodo
2008-04-14 05:39 --------- d-----w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\Azureus
2008-04-14 04:32 --------- d-----w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\SiteAdvisor
2008-04-04 06:44 --------- d-----w C:\Program Files\Vidomi
2008-03-31 21:25 831,488 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 21:25 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-30 05:44 3,932 -c--a-w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\LMLayout.dat
2008-03-30 05:44 268 -c--a-w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\LMCPaper.dat
2008-03-29 06:22 2,572 ----a-w C:\WINDOWS\WINDVDBOOTRECDOE.sys
2008-03-29 03:24 47,360 ----a-w C:\Documents and Settings\Administrator.D-55ADED1AFAB64\Application Data\pcouffin.sys
2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-20 16:32 1,295,938 ----a-r C:\WINDOWS\SET10A.tmp
2008-03-20 16:25 1,088,979 ----a-r C:\WINDOWS\SET10B.tmp
2008-03-20 16:24 16,674 ----a-r C:\WINDOWS\SET117.tmp
2008-03-20 16:07 23,552 ----a-w C:\WINDOWS\system32\wdmaud.drv
2008-03-20 16:06 74,752 ----a-w C:\WINDOWS\system32\storprop.dll
2008-03-20 16:06 53,760 ----a-w C:\WINDOWS\system32\vfwwdm32.dll
2008-03-20 16:06 4,096 ----a-w C:\WINDOWS\system32\ksuser.dll
2008-03-20 16:06 159,232 ----a-w C:\WINDOWS\system32\ptpusd.dll
2008-03-20 14:49 1,804 ----a-w C:\WINDOWS\system32\Dcache.bin
2008-03-20 14:45 74,240 ----a-w C:\WINDOWS\system32\usbui.dll
2008-03-20 14:45 52,736 ----a-w C:\WINDOWS\system32\wzcsapi.dll
2008-03-20 14:45 52,224 ----a-w C:\WINDOWS\system32\dmutil.dll
2008-03-20 14:45 483,840 ----a-w C:\WINDOWS\system32\wzcsvc.dll
2008-03-20 14:45 47,616 ----a-w C:\WINDOWS\system32\iyuv_32.dll
2008-03-20 14:45 47,104 ----a-w C:\WINDOWS\system32\cnbjmon.dll
2008-03-20 14:45 35,328 ----a-w C:\WINDOWS\system32\pid.dll
2008-03-20 14:45 294,912 ----a-w C:\WINDOWS\system32\msh263.drv
2008-03-20 14:45 20,992 ----a-w C:\WINDOWS\system32\hid.dll
2008-03-20 14:45 2,065,792 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((( snapshot@2008-06-02_17.51.51.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-01 22:15:51 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-02 09:03:51 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-02 09:04:09 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_66c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-03-21 00:06 15360]
"InternodeUsage"="C:\PROGRA~1\Internode\mum.exe" [2008-03-01 15:24 1334272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 08:49 79224]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-02-11 07:02 1115728]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-01-27 15:08 316728]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 01:17 55824 C:\WINDOWS\KHALMNPR.Exe]
"BOC-425"="C:\PROGRA~1\Comodo\CBOClean\BOC425.exe" [2007-08-08 19:49 338432]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 01:17 55824 C:\WINDOWS\KHALMNPR.Exe]
"dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2008-03-01 14:49 826880]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-24 06:48 443968]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [4/20/2008 3:27:43 PM 303104]
Lexmark X125 Settings Utility.lnk - C:\Program Files\Lexmark X125\LEX125SU.exe [2/5/2007 10:21:00 AM 1810432]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [10/30/2007 3:57:25 PM 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2/16/2008 6:08:47 AM 789008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2008-01-09 11:30 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
"vidc.xvid"= xvid.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\CTFMON.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\LMpdpsrv.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\Raven\\SOF PLATINUM\\SoF.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 08:50]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 08:46]
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-03-20 19:37]
S2 Ca533av;Mega DV(Video);C:\WINDOWS\system32\Drivers\Ca533av.sys [2002-08-07 18:33]
S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
S3 upperdev;upperdev;C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39]
S3 USBCamera;DSC Still Image Capture (CA533A);C:\WINDOWS\system32\Drivers\Bulk533.sys [2002-07-25 11:19]
S3 UsbserFilt;UsbserFilt;C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 10:10:54 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 20:12:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-02 20:15:34
ComboFix-quarantined-files.txt 2008-06-02 10:45:29
ComboFix2.txt 2008-06-02 08:22:13

Pre-Run: 9,364,733,952 bytes free
Post-Run: 9,349,279,744 bytes free

267 --- E O F --- 2008-05-28 07:09:30

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:37:10, on 6/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Internode\mum.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Qlock\qlock.exe
C:\Program Files\Shrink Pic\shrink_pic.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Comodo\Firewall\cpfupdat.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [InternodeUsage] C:\PROGRA~1\Internode\mum.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: ATO.lnk = E:\OnlineServicesSetup.exe
O4 - Startup: qlock.lnk = C:\Program Files\Qlock\qlock.exe
O4 - Startup: Shrink Pic.lnk = C:\Program Files\Shrink Pic\shrink_pic.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208426921243
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: schmap-help - (no CLSID) - (no file)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10109 bytes

Happy reading. Going off line until tomorrow. (Its getting late here!)

Thanks

Do you have the malwarebytes report also.
dan

Sorry, thought I put it in It was getting late


Malwarebytes' Anti-Malware 1.14
Database version: 814

21:36:26 6/2/2008
mbam-log-6-2-2008 (21-36-26).txt

Scan type: Full Scan (C:\|)
Objects scanned: 275672
Time elapsed: 1 hour(s), 9 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:



5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.


Ok, let's have an online scan.

1 - Kaspersky Online Scan
With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
Please do an online scan with >Kaspersky Online Scanner<. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.

• The program will launch and then start to download the latest definition files.
  
• Once the scanner is installed and the definitions downloaded, click Next.
  
• Now click on Scan Settings
  
• In the scan settings make sure that the following are selected:
  o Scan using the following Anti-Virus database:
  + Extended (If available otherwise Standard)
  o Scan Options:
  + Scan Archives
  + Scan Mail Bases
  
• Click OK
  
• Now under select a target to scan select My Computer
  
• The scan will take a while so be patient and let it run.
  
• Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
  
• Click the Save Report As... button (see red arrow below)
  
  
  
  
• In the Save as... prompt, select Desktop
  
• In the File name box, name the file KasScan-ddmmyy (or similar)
  
• In the Save as type prompt, select Text file (see below)
  
  
  
  
• Copy and paste the report in your next post.

Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and to speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.

Post me the uninstall list plus the kaspersky scan report.
dan

Thanks, will do the big scan tomorrow when I have more time. Do I need to turn off firewall as well?

Here is the HJT log you asked for.

1Click DVD Copy Pro 3.1.3.9
Ad-Aware 2007
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit 2
Adobe Flash Player ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Photoshop CS3
Adobe Reader 8.1.2
Adobe Setup
Adobe Setup
Adobe Setup
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Advanced WindowsCare Personal
Apple Mobile Device Support
Apple Software Update
a-squared Free 2.1
avast! Antivirus
AVG Anti-Spyware 7.5
Azureus Vuze
BlueSoleil
BOClean
CCleaner (remove only)
CDDRV_Installer
Common-Use Signing Interface
COMODO Firewall Pro
DivX Codec
DivX Converter
DivX Player
DivX Web Player
DVD Shrink 3.2
DVD43 v4.2.0
Easy CD Creator 5 Basic
ECI Client v5.0.5
filehippo.com Update Checker
FinePix Studio
FinePixViewer Resource
FinePixViewer Ver.5.3
FLAC 1.2.1b (remove only)
FUJIFILM USB Driver
Garmin WebUpdater
Gogo MP3 To CD Burner
Google Earth
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
HP Precisionscan Pro 3.1
HP USB Disk Storage Format Tool
ImageMixer VCD for FinePix
ImageMixer VCD2 LE for FinePix
ImgBurn
InterActual Player
Internode Monthly Usage Meter 7.1i
iTunes
Java(TM) 6 Update 6
KhalInstallWrapper
Lexmark X125
LimeWire 4.16.7
Logitech Desktop Messenger
Logitech SetPoint
Malwarebytes' Anti-Malware
Mega DV Manager
Messenger Plus! Live & Sponsor (CiD)
Microsoft DirectX Transform optional components
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft Visual C# 2005 Express Edition - ENU
Microsoft Visual C# 2005 Express Edition - ENU Service Pack 1 (KB926749)
Microsoft Visual C++ 2005 Redistributable
MicroStaff WINASPI NT
Mozilla Firefox (2.0.0.14)
Mozilla Thunderbird (2.0.0.14)
MP3 Player Utilities 4.13
MP3 Wav Editor 3.30
MSVC80_x86
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
MYOB BusinessBasics v1
Nero Suite
No One Lives Forever 2
Nokia Connectivity Cable Driver
Nokia Multimedia Factory
Nokia Multimedia Factory
Nokia PC Suite
Nokia PC Suite
Nokia Software Updater
Nokia Video Manager
Nokia Video Manager
NVIDIA Drivers
OpenOffice.org Installer 1.0
PC Connectivity Solution
PCI Audio Applications
PCI Audio Driver
PDF Settings
PDFCreator
PDFCreator Toolbar
PeerGuardian 2.0
Picasa 2
PL-2303 USB-to-Serial
Qlock Lite
Quake II
Quake II MP: Ground Zero
QuickTime
RealPlayer
Rhapsody Player Engine
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows XP (KB923789)
Serif PagePlus 10.0
Serif PagePlus 10.0 Resource CD-ROM
Shockwave
Shrink Pic (remove)
SigmaTel MSCN Audio Player
Smart DVD Creator Pro
Soldier of Fortune Platinum
Spybot - Search & Destroy
Spybot - Search & Destroy 1.5.2.20
SpywareBlaster 4.0
SUPERAntiSpyware Free Edition
tinySpell 1.5
Tweak UI
UMVPLStandalone
Uninstall Startup Inspector
Update for Windows XP (KB942763)
VideoLAN VLC media player 0.8.6f
Windows Driver Package - Nokia Modem (03/05/2008 3.7)
Windows Driver Package - Nokia Modem (03/13/2008 6.86.0.1)
Windows Driver Package - Nokia Modem (08/03/2007 6.84.0.2)
Windows Driver Package - Nokia Modem (10/12/2007 3.6)
Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)
Windows Internet Explorer 7
Windows Live installer
Windows Live Messenger
Windows Live Sign-in Assistant
WinHTTP QFE
WinPatrol 2007
WinPatrol 2007 Restore/Remove First
WinPatrol 2007 Step 2
WinRAR archiver
WinZip 10.0

Do I need to turn off firewall as well?

only for the duration of the scan, just have the scan running nothing else.

Here is the other scan, took forever, but seems to have found lots!


-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, June 04, 2008 9:30:33 PM
Operating System: Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 4/06/2008
Kaspersky Anti-Virus database records: 828169
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 225668
Number of viruses found: 18
Number of infected objects: 354
Number of suspicious objects: 81
Duration of the scan process: 04:24:37

Infected Object Name / Virus Name / Last Action
C:\d65974f140db0c2ed8f5b306278fed\$shtdwn$.req Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\SP2QFE\acadproc.dll Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\SP2QFE\apphelp.sdb Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\SP2QFE\apph_sp.sdb Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\SP2QFE\sysmain.sdb Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\spmsg.dll Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\spuninst.exe Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\update\branches.inf Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\update\eula.txt Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\update\KB926239.CAT Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\update\spcustom.dll Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\update\update.exe Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\update\update.ver Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\update\updatebr.inf Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\update\update_SP2QFE.inf Object is locked skipped
C:\d65974f140db0c2ed8f5b306278fed\update\updspapi.dll Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED/[From Trent Von <Mandy0j ... /[ ... /[From ... /[From [removed]][Date Tue, 14 Dec 2004 21:28:01 +0000]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED/[From Trent Von <Mandy0j ... /[ ... /[From "Hsbq.Ortega" <[removed]>][Date Tue, 14 Dec 2004 22:43:31 +0400]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED/[From Trent Von <Mandy0j ... /[ ... /[From "Kelsey Finch" <[removed]>][Date Tue, 14 Dec 2004 13:32:02 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED/[From Trent Von <Mandy0j ... /[From Griselda Colette <[removed]>][Date Tue, 14 Dec 2004 09:56:18 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED/[From Trent Von <[removed]>][Date Tue, 14 Dec 2004 08:41:46 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html/[From "Looped I. Buckboards" <Ryd .. ... /[From Wamu online support <[removed]>][Date Wed, 15 Dec 2004 16:01:57 +0000]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html/[From "Looped I. Buckboards" <Ryd ... /[From Napster Replacement <[removed]>][Date Thu, 16 Dec 2004 07:50:00 +0300]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html/[From "Looped I. Buckboards" <Ryd ... /[From "Ebbz.Chase" <[removed]>][Date Wed, 15 Dec 2004 04:44:26 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html/[From "Looped I. Buckboards" <[removed]>][Date Wed, 15 Dec 2004 05:15:04 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "France .. ... /[From [removed]][Date Fri, 24 Dec 2004 16:24:22 +0000]/html Infected: Trojan-Spy.HTML.Bankfraud.bv skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "France ... /[From "Fraud Prevention Department" <[removed]>][Date Fri, 24 Dec 2004 12:05:00 +0000]/html Infected: Trojan-Spy.HTML.Bankfraud.bv skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... /[F ... /[F ... /[From West Banking Dept <[removed]>][Date Mon, 27 Dec 2004 17:38:40 +0000]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... /[ ... /[Fro ... /[From West Card Dept <[removed]>][Date Tue, 28 Dec 2004 07:50:34 +0000]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... /[ ... /[From "Replicas" <[removed]>][Date Mon, 27 Dec 2004 22:54:12 -0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... /[ ... /[From "Trisha Evans" <[removed]>][Date Mon, 27 Dec 2004 11:23:59 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... /[F ... /[From "Kbay.Singh" <[removed]>][Date Mon, 27 Dec 2004 05:17:09 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... /[From =?utf-8?q?Benny Glr?= <[removed]>][Date Mon, 27 Dec 2004 02:41:11 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... / ... ... /[From Al ... /[From "Horace" <[removed]>][Date Mon, 27 Dec 2004 02:18:05 +0400]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... / ... ... /[From Alicia Janel <[removed]>][Date Sun, 26 Dec 2004 14:32:57 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... / ... / ... /[From "Gonzalo Magee" <[removed]>][Date Sun, 26 Dec 2004 21:46:10 +0800]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... / ... /[From "Colin Starnes" <[removed]>][Date Sun, 26 Dec 2004 15:16:54 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... / .. ... /[From "Betty Dixon" <[removed]>][Date Sun, 26 Dec 2004 03:46:51 -0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... / ... /[From "Tia Staley" <[removed]>][Date Sun, 26 Dec 2004 06:24:16 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... /[ ... /[From "Jeanette Stone" <[removed]>][Date Sat, 25 Dec 2004 10:45:37 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Fran ... /[From =?utf-8?q?Emma Htpore?= <[removed]>][Date Sat, 25 Dec 2004 17:05:01 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Franc ... /[From "Patience Vanessa" <[removed]>][Date Sat, 25 Dec 2004 06:42:44 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "France .. . ... /[From "Kimmy Ross" <[removed]>][Date Sat, 25 Dec 2004 06:42:41 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "France .. ... /[From Music Download Newsletter <[removed]>][Date Sat, 25 Dec 2004 09:18:21 +0600]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "France ... /[ ... /[ ... /[From "Elsa John" <[removed]>][Date Fri, 24 Dec 2004 17:19:10 -0100]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "France ... /[ ... /[From "Virgie Pickett" <[removed]>][Date Fri, 24 Dec 2004 05:58:38 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "France ... /[From "Tamika Crockett" <[removed]>][Date Fri, 24 Dec 2004 14:04:46 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "France ... /[From "Cheating wives " <[removed]>][Date Fri, 24 Dec 2004 02:37:59 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Frances Story" <[removed]>][Date Fri, 24 Dec 2004 09:09:04 -0300]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince ... /[From "[removed]" <[removed]>][Date Tue, 18 Jan 2005 06:59:18 -010 ... /html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince ... /[From "[removed]" <[removed]>][Date Tue, 18 Jan 2005 06:59:18 -0100]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. ... ... /[From "Margret Steve" <[removed]>][Date Mon, 17 Jan 2005 14:20:06 -0700]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. ... /[Fr ... /[From "Toby" <[removed]>][Date Mon, 17 Jan 2005 09:34:44 -0800]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. ... /[From "Hugh Roman" <[removed]>][Date Tue, 18 Jan 2005 10:51:07 +0300]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. ... ... /[From "Gregory Dean" <[removed]>][Date Mon, 17 Jan 2005 13:43:06 -0300]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. ... /[From "Jean Bartley" <[removed]>][Date Mon, 17 Jan 2005 12:15:41 -0200]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. ... /[From "Ulric Lester" <[removed]>][Date Mon, 17 Jan 2005 08:02:17 -0600]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. .. ... /[From "Major Freeman" <[removed]>][Date Mon, 17 Jan 2005 08:02:03 -0600]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. .. ... /[From "Patti S. Barrett" <[removed]>][Date Mon, 17 Jan 2005 06:03:28 -0600]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. .. ... /[From "Sidney Swartz" <[removed]>][Date Mon, 17 Jan 2005 13:14:28 -0100]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak .. ... /[From "Tonia Childs" <[removed]>][Date Mon, 17 Jan 2005 21:03:00 -0700]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak ... /[Fr ... /[From "Kareem" <[removed]>][Date Mon, 17 Jan 2005 07:48:58 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak ... /[From " ... /[From Ernest Baldwin <[removed]>][Date Mon, 17 Jan 2005 10:25:46 -0100]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak ... /[From "Brandy Greer" <[removed]>][Date Mon, 17 Jan 2005 06:09:17 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Ak ... /[From "Cameron Denton" <[removed]>][Date Mon, 17 Jan 2005 06:09:08 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Akins][Date Mon, 17 Jan 2005 10:38:26 +0000]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <hqagq@cgocabl ... /[Fro ... /[From "Francis Jacobson" <[removed]>][Date Sun, 13 Feb 2005 21:29:43 - .. ... /text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <hqagq@cgocabl ... /[Fro ... /[From "Francis Jacobson" <[removed]>][Date Sun, 13 Feb 2005 21:29:43 - ... /UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <hqagq@cgocabl ... /[Fro ... /[From "Francis Jacobson" <[removed]>][Date Sun, 13 Feb 2005 21:29:43 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <hqagq@cgocabl ... /[From =?utf-8?q?Ra ... /[From "keromail.com" <[removed]>][Date Thu, 10 Feb 2005 03:30:12 -0800]/text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <hqagq@cgocabl ... /[From =?utf-8?q?Ranald Xaumedhs?= <[removed]>][Date Thu, 10 Feb 2005 10:23:32 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>] ... / ... /[From "Ned Geoff" <[removed]>][Date Thu, 10 Feb 2005 02:39:23 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>] ... /[From " ... /[From "Kerry Tatum" <[removed]>][Date Thu, 10 Feb 2005 00:34:52 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>] ... /[From "butterfield Cross" <[removed]>][Date Thu, 10 Feb 2005 00:23:23 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>][D ... ... ... /[From "Ronna Jacquetta" <[removed]>][Date Thu, 10 Feb 2005 00:30:46 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>][D ... ... /[From "Silvia Madden" <[removed] >][Date Thu, 10 Feb 2005 05:04:35 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>][D ... /[From "Randall Hudson" <[removed]>][Date Wed, 09 Feb 2005 20:24:07 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>][Date Wed, ... /[ ... /[From Donna Ritter <[removed]>][Date Thu, 10 Feb 2005 01:10:13 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>][Date Wed, ... /[From "Sam Cartwright" <[removed]>][Date Wed, 09 Feb 2005 17:08:24 -0600]/text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>][Date Wed, 09 Feb 2005 15:56:20 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text/[From Alexandra Wa ... / ... /[From [removed]][Date Fri, 18 Feb 2005 11:46:37 -060 ... /html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text/[From Alexandra Wa ... / ... /[From [removed]][Date Fri, 18 Feb 2005 11:46:37 -0600]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text/[From Alexandra Wa ... /[From "Brenda Sprague" <[removed]>][Date Fri, 18 Feb 2005 07:30:18 -0700]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text/[From Alexandra Wa ... /[From "Janelle Lynch" <[removed]>][Date Fri, 18 Feb 2005 13:52:55 +0000]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text/[From Alexandra Wa ... /[Fro ... /[From "Mari Mahoney" <[removed]>][Date Fri, 18 Feb 2005 10:46:33 -0300]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text/[From Alexandra Wa ... /[From "Aviation P. Perfumes" <[removed]>][Date Fri, 18 Feb 2005 05:14:41 -0800]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text/[From Alexandra Wat ... /[From "Tro S. Valine" <[removed]>][Date Fri, 18 Feb 2005 03:51:20 -0800]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text/[From Alexandra Watts <[removed]>][Date Fri, 18 Feb 2005 06:21:43 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From "Heidi Wilkie" <johnny.e ... /[From Washington Mutual Support <[removed]>][Date Sun, 20 Feb 2005 16:05:55 + .. ... /text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From "Heidi Wilkie" <johnny.e ... /[From Washington Mutual Support <[removed]>][Date Sun, 20 Feb 2005 16:05:55 + .. ... /html Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From "Heidi Wilkie" <johnny.e ... /[From Washington Mutual Support <[removed]>][Date Sun, 20 Feb 2005 16:05:55 + ... /UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From "Heidi Wilkie" <johnny.e ... /[From Washington Mutual Support <[removed]>][Date Sun, 20 Feb 2005 16:05:55 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From "Heidi Wilkie" <johnny.evelyn@astro ... /[From "Ella Judd" <[removed]>][Date Sun, 20 Feb 2005 05:41:29 -0600]/text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From "Heidi Wilkie" <[removed]>][Date Sun, 20 Feb 2005 09:02:41 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[F ... /[Fro ... /[From Ebay.com Security Team <[removed]>][Date 1 Mar 2005 04:06:2 ... /UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[F ... /[Fro ... /[From Ebay.com Security Team <[removed]>][Date 1 Mar 2005 04:06:24 -0000]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[F ... /[From "Larl ... /[From "Megan Molina" <[removed]>][Date 14 Feb 2005 06:36:10 -0700]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From ... /[From "=?iso-8859-1?B?Rn ... /[From Halifax bank <[removed]>][Date Tue, 01 Mar 2005 15:57:22 +0400]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From ... /[From "=?iso-8859-1?B?RnJlc2hsaXZpbmcuY29t?="<[removed]>][Date Mon, 28 Feb 2005 21:21:31 +0000 (GMT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" ... /[From "Adult Offers" <[removed]>][Date Mon, 28 Feb 2005 22:46:10 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[F ... /[Fr ... /[From Janessa Gwen <[removed]>][Date Mon, 28 Feb 2005 22:18:55 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[F ... /[From "Larles Q. Bill" <[removed]>][Date Mon, 28 Feb 2005 17:32:06 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[Fr ... /[F ... /[From "Sean Smith" <[removed]>][Date Mon, 28 Feb 2005 23:02:50 +0100]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[Fr ... /[From "Griffin Braxton" <[removed]>][Date Mon, 28 Feb 2005 15:28:24 -0600]/text Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[Fro ... ... /[From Freeman Dawson <[removed]>][Date Mon, 28 Feb 2005 11:21:11 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[Fro ... /[From "Hallie Brennan" <[removed]>][Date Mon, 28 Feb 2005 12:19:58 -0600]/text Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@ ... /[From "Wilfred Fitzroy" <[removed]>][Date Mon, 28 Feb 2005 12:19:55 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@wa ... /[From ... /[From "Dr. A. Yoder" <[removed]>][Date Mon, 28 Feb 2005 10:14:30 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@wa ... /[From " ... /[From "Martiniere" <[removed]>][Date Mon, 28 Feb 2005 23:24:17 +0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@wa ... /[From "bl . ... /[From "Ethan Hardy" <[removed]>][Date Mon, 28 Feb 2005 12:33:59 -0600]/text Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@wa ... /[From "bl ... /[From "Landon Maloney" <[removed]>][Date Mon, 28 Feb 2005 19:36:45 +0300]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <bqbslzvb@wa ... /[From "bloomington Shultz" <[removed]>][Date Fri, 25 Feb 2005 02:22:32 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <[removed]>][ ... /[From ... /[From "Geffen Wendy"<[removed]>][Date Thu, 24 Feb 2005 22:32:41 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <[removed]>][ ... /[From Bernardo Quinones <[removed]>][Date Fri, 25 Feb 2005 07:03:24 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <[removed]>][Date Fri, 25 Feb 2005 04:39:16 -0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[Fro ... /[From Team Fusion at ... / ... /[From [removed] <[removed]>][Date 16 Mar 2005 13:19:02 -0000]/html Infected: Trojan-Spy.HTML.Bayfraud.em skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[Fro ... /[From Team ... /[From Angela Gu ... /[From "eBay Support" <[removed]>][Date Sun, 3 Apr 2005 12:51:18 -0400]/html Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[Fro ... /[From Team ... /[From Angela Guadalupe <[removed]>][Date Sun, 03 Apr 2005 03:25:35 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[Fro ... /[From Team Fusion .. ... /[From "Elliot Baldwin" <[removed]>][Date Sun, 03 Apr 2005 19:55:22 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[Fro ... /[From Team Fusion ... /[From "Marvin Kirkpatrick" <[removed]>][Date Sat, 02 Apr 2005 19:35:03 -0600]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[Fro ... /[From Team Fusion at ... /[From ... /[From "Gibney" <[removed]>][Date Sun, 03 Apr 2005 02:29:53 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[Fro ... /[From Team Fusion at ... /[From "Jean Hutchison" <[removed]>][Date Sat, 02 Apr 2005 17:47:05 +0400]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[Fro ... /[From Team Fusion at ... /[From from multipart/alternative by demime 0.91d][Date Fri, 11 Mar 2005 07:04:34 +0300]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[Fro ... /[From Team Fusion at Website Pros <[removed]>][Date Thu, 10 Mar 2005 14:34:34 -0500 (EST)]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[From "Vicente Dahl" <WEPONDKVXP .. ... /[From "Carly" <[removed]>][Date Thu, 10 Mar 2005 13:08:07 +0600]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[From "Vicente Dahl" <WEPONDKVXP ... /[From "Jane Jeffers" <[removed]>][Date Fri, 11 Mar 2005 01:15:45 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text/[From "Vicente Dahl" <[removed]>][Date Thu, 10 Mar 2005 20:33:08 -0300]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED/[From "Leslie Rankin" <[removed]>][Date Thu, 10 Mar 2005 19:09:51 -0400]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED/[From "Alyson" <[removed]>][Date Thu, 10 Mar 2005 23:39:30 +0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED/[From "BoatTraderOnline.com" <[removed]>][Date Thu, 10 Mar 2005 17:54:19 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From "Charter One Bank" <[removed]>][Date Sun, 17 Apr 2005 05:25:22 +0100]/html Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... ... ... /[From "[removed]" <[removed]>][Date Tue, 19 Apr 2005 23:20:48 +0000]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... . .. ... ... /[From "eBay Support" <[removed]>][Date Thu, 21 Apr 2005 02:32:12 +0900]/html Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... . .. ... ... /[From Freda Kade <[removed]>][Date Wed, 20 Apr 2005 09:49:18 -0700]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... . .. ... /[ ... /[From "J.Mayes" <[removed]>][Date Wed, 20 Apr 2005 10:08:30 -0400]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... . .. ... /[F ... ... /[From "Billian" <[removed]>][Date Tue, 19 Apr 2005 23:25:44 -0800]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... . .. ... /[F ... /[From Jill <[removed]>][Date Wed, 20 Apr 2005 04:07:42 -0700 (CST)]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... . .. ... /[From "Jacobs Kristopher " <[removed]>][Date Wed, 20 Apr 2005 06:05:43 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... . .. ... /[From "Krista Eddy" <[removed]>][Date Wed, 20 Apr 2005 15:53:47 +0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... . ... /[From "Theodore Goldsmith" <[removed]>][Date Wed, 20 Apr 2005 10:00:01 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... ... ... /[From "Phillip Buckner" <[removed]>][Date Wed, 20 Apr 2005 01:50:33 -0500]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... ... /[ ... ... /[From "Tanya" <[removed]>][Date Wed, 20 Apr 2005 05:02:27 -0200]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... ... /[ ... /[From Wiley Durham <[removed]>][Date Tue, 19 Apr 2005 19:00:28 +0000]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... ... /[From "Rebeckah Paden" <[removed]>][Date Tue, 19 Apr 2005 20:12:57 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... ... /[From "Diann Caldwell" <[removed]>][Date Wed, 20 Apr 2005 01:13:05 +0200]/text Infected: Trojan-Spy.HTML.Bayfraud.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[F ... ... /[From "Charter One Bank" <[removed]>][Date Tue, 26 Apr 2005 17:17:35 +0600]/html Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[F ... /[ ... /[From "Kerry Ligwith" <[removed]>][Date Tue, 26 Apr 2005 12:59:47 +0200]/html Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[F ... /[ ... /[From "Trisha Wills" <[removed]>][Date Tue, 26 Apr 2005 14:01:53 +0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[F ... /[ ... ... /[From "Nicolas" <[removed] >][Date Tue, 26 Apr 2005 11:56:22 -0800]/html Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[F ... /[ ... /[From "Melissa French" <[removed]>][Date Tue, 19 Apr 2005 18:56:43 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[F ... /[F ... /[From [removed]][Date Tue, 19 Apr 2005 17:08:56 -050 ... /html Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[F ... /[F ... /[From [removed]][Date Tue, 19 Apr 2005 17:08:56 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[F ... /[From "clomp Jeffers" < ... /[From <[removed]>][Date Wed, 20 Apr 2005 04:19:33 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[F ... /[From "clomp Jeffers" <[removed]>][Date Tue, 19 Apr 2005 17:28:48 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[From ... /[From Tammie Miller <[removed]>][Date Tue, 19 Apr 2005 00:12:08 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[From 1.1 AWL ... /[From Maurice Regan <[removed]>][Date Tue, 19 Apr 2005 10:42:13 -0700]/text Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[From 1.1 AWL AWL: From: addre ... /[From <[removed]>][Date Sun, 17 Apr 2005 23:59:09 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <wgqrunwulnxw@dar ... /[From 1.1 AWL AWL: From: address is in the auto white-list][Date Sun, 17 Apr 2005 10:54:06 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <[removed]>][Date Sun, ... /[From Kayla Baird <[removed]>][Date Sun, 17 Apr 2005 12:02:00 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED/[From "Carter Kirkland" <[removed]>][Date Sun, 17 Apr 2005 06:05:54 -0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED/[From Emanuel <[removed]>][Date Sat, 16 Apr 2005 19:29:15 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text/[From "Tuan Evia" <[removed]>][Date Sun, 17 Apr 2005 03:28:23 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED/[From "Dave" <[removed]>][Date Thu, 14 Apr 2005 21:06:38 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.dh skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Toby" <[removed]>][Date Mon, 16 May 2005 15:40:52 -0800]/text/[From "Dane Milton" <[removed]>][Date Tue, 17 May 2005 11:09:04 +0300]/UNNAMED/[From "Sherrie Rubio" <[removed]>][Date Sun, 16 May 2004 20:02:11 +0000]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Toby" <[removed]>][Date Mon, 16 May 2005 15:40:52 -0800]/text/[From "Dane Milton" <[removed]>][Date Tue, 17 May 2005 11:09:04 +0300]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Toby" <[removed]>][Date Mon, 16 May 2005 15:40:52 -0800]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Connie Rowe" <[removed]>][Date Thu, 19 May 2005 06:29:51 -0800]/UNNAMED/[From Bennett Barrett <[removed]>][Date Thu, 19 May 2005 10:05:33 -0700]/UNNAMED/[From HSBC Banking <[removed]>][Date Thu, 19 May 2005 17:10:02 +0000]/UNNAMED/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Connie Rowe" <[removed]>][Date Thu, 19 May 2005 06:29:51 -0800]/UNNAMED/[From Bennett Barrett <[removed]>][Date Thu, 19 May 2005 10:05:33 -0700]/UNNAMED/[From HSBC Banking <[removed]>][Date Thu, 19 May 2005 17:10:02 +0000]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Connie Rowe" <[removed]>][Date Thu, 19 May 2005 06:29:51 -0800]/UNNAMED/[From Bennett Barrett <[removed]>][Date Thu, 19 May 2005 10:05:33 -0700]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Connie Rowe" <[removed]>][Date Thu, 19 May 2005 06:29:51 -0800]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Robin Hannah" <[removed]>][Date Sat, 21 May 2005 20:12:31 +0600]/UNNAMED/[From Fmwz95wr <[removed]>][Date Sat, 21 May 2005 16:33:59 +0000]/html Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Robin Hannah" <[removed]>][Date Sat, 21 May 2005 20:12:31 +0600]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From Dequan Kristy <[removed]>][Date Sat, 21 May 2005 13:10:51 -0700]/UNNAMED/[From Adolfo Brady <[removed]>][Date Sun, 22 May 2005 02:00:48 +0400]/UNNAMED/[From "PayPal" <[removed]>][Date Sun, 22 May 2005 01:15:16 +0300]/html Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From Dequan Kristy <[removed]>][Date Sat, 21 May 2005 13:10:51 -0700]/UNNAMED/[From Adolfo Brady <[removed]>][Date Sun, 22 May 2005 02:00:48 +0400]/UNNAMED/[From Robbie Audra <Margie ... /[From "PayPal" <[removed]>][Date Sat, 21 May 2005 19:52:46 -0500]/html Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From Dequan Kristy <[removed]>][Date Sat, 21 May 2005 13:10:51 -0700]/UNNAMED/[From Adolfo Brady <[removed]>][Date Sun, 22 May 2005 02:00:48 +0400]/UNNAMED/[From Robbie Audra <[removed]>][Date Sat, 21 May 2005 15:59:39 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From Dequan Kristy <[removed]>][Date Sat, 21 May 2005 13:10:51 -0700]/UNNAMED/[From Adolfo Brady <[removed]>][Date Sun, 22 May 2005 02:00:48 +0400]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From Dequan Kristy <[removed]>][Date Sat, 21 May 2005 13:10:51 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Louise Carlisle" <[removed]>][Date Sat, 21 May 2005 22:50:20 -0500]/UNNAMED/[From Franklin Jules <[removed]>][Date Sun, 22 May 2005 03:00:00 +0000]/UNNAMED/[From "PayPal" <[removed]>][Date Sun, 22 May 2005 09:17:20 +0500]/html Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Louise Carlisle" <[removed]>][Date Sat, 21 May 2005 22:50:20 -0500]/UNNAMED/[From Franklin Jules <[removed]>][Date Sun, 22 May 2005 03:00:00 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Louise Carlisle" <[removed]>][Date Sat, 21 May 2005 22:50:20 -0500]/UNNAMED/[From "Marvin Bradford" <[removed]>][Date Mon, 23 May 2005 03:55:12 -0800]/html/[From Codie Joanne <Maega ... /[From "PayPal" <[removed]>][Date Sun, 22 May 2005 12:28:53 -0700]/html Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Louise Carlisle" <[removed]>][Date Sat, 21 May 2005 22:50:20 -0500]/UNNAMED/[From "Marvin Bradford" <[removed]>][Date Mon, 23 May 2005 03:55:12 -0800]/html/[From Codie Joanne <[removed]>][Date Sun, 22 May 2005 11:04:09 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Louise Carlisle" <[removed]>][Date Sat, 21 May 2005 22:50:20 -0500]/UNNAMED/[From "Marvin Bradford" <[removed]>][Date Mon, 23 May 2005 03:55:12 -0800]/html Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From "Louise Carlisle" <[removed]>][Date Sat, 21 May 2005 22:50:20 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From Krysta Daryl <[removed]>][Date Fri, 27 May 2005 15:33:09 -0700]/UNNAMED/[From [removed] <[removed]>][Date Fri, 27 May 2005 18:28:58 -0700 (PDT)]/html Infected: Trojan-Spy.HTML.Bayfraud.gm skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED/[From Krysta Daryl <[removed]>][Date Fri, 27 May 2005 15:33:09 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.gm skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED/[From "Bryant Kincaid" <[removed]>][Date Thu, 12 May 2005 08:19:09 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.gm skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bayfraud.gm skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From ... /[Fro ... /[Fro ... /[From "PayPal" <[removed]>][Date Sun, 12 Jun 2005 11:39:10 -0100]/html Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From ... /[Fro ... /[Fro ... /[From "Dalton" <[removed]>][Date Sun, 12 Jun 2005 11:46:34 +0000]/text Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From ... /[Fro ... /[From "Adela Moody" <[removed]>][Date Sun, 12 Jun 2005 02:58:19 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From ... /[From "Gene Grayson" <[removed]>][Date Sat, 11 Jun 2005 23:33:27 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "R ... /[ ... /[From "Eliza Franks" <[removed]>][Date Sun, 12 Jun 2005 02:23:51 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "R ... /[From "Roosevelt Connelly" <[removed]>][Date Sun, 12 Jun 2005 07:17:44 -0000]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Re . ... /[ ... /[From "Aaron Lugo" <[removed]>][Date Sat, 11 Jun 2005 18:12:10 -0600]/html Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Re . ... /[From [removed] <[removed]>][Date Fri, 10 Jun 2005 18:48:37 -0600]/html Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Re . ... /[From "Ronny Diggs" <[removed]>][Date Fri, 10 Jun 2005 16:56:28 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Re ... /[From Brock Herbert <[removed]>][Date Fri, 10 Jun 2005 17:15:37 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Re . ... /[From "Cancer " <[removed]>][Date Sat, 11 Jun 2005 05:00:30 +0600]/UNNAMED Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Re ... /[From "Scrupulous E. Herds" <[removed]>][Date Fri, 10 Jun 2005 13:52:06 -0400]/text Infected: Trojan-Spy.HTML.Paylap.ev skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Reyes H ... /[From Daryl De ... /[From <[removed]>][Date Wed, 13 Jul 2005 08:52:10 +0300]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Reyes H ... /[From Daryl De ... /[From [removed]][Date Wed, 13 Jul 2005 06:43:42 +0100]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Reyes H ... /[From Daryl Denis <[removed]>][Date Tue, 12 Jul 2005 20:18:02 -0700]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adr ... /[From "Reyes Hager" <[removed]>][Date Thu, 09 Jun 2005 17:19:38 +0400]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adrianne Orion <Reginah ... /[From "janis cooper" <[removed]>][Date Wed, 08 Jun 2005 20:25:17 +0300]/html Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adrianne Orion <Reginahh ... /[From "Marlene Nadeau" <[removed]>][Date Wed, 08 Jun 2005 14:03:09 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED/[From Adrianne Orion <[removed]>][Date Wed, 08 Jun 2005 22:30:54 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED/[From Rosanna Baker <[removed]>][Date Thu, 09 Jun 2005 00:21:19 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED/[From "Dan Haas" <[removed]>][Date Wed, 08 Jun 2005 22:45:40 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED/[From Ursula Fuentes <[removed]>][Date Wed, 08 Jun 2005 23:42:03 +0300 (CST)]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text/[From Joshua Layla <[removed]>][Date Thu, 28 Jul 2005 11:36:54 -0700]/UNNAMED/[From "Steve Robinson" <[removed]>][Date Wed, 3 Aug 2005 18:55:24 +0100]/text/[From [removed]][Date Wed, 03 Aug 2005 11:33:30 PDT]/UNNAMED/[From "Ariana Johnson" <a ... ... /[From "Mary Garner ... /[From <[removed]>][Date Sun, 7 Aug 2005 03:15:03 +0300]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text/[From Joshua Layla <[removed]>][Date Thu, 28 Jul 2005 11:36:54 -0700]/UNNAMED/[From "Steve Robinson" <[removed]>][Date Wed, 3 Aug 2005 18:55:24 +0100]/text/[From [removed]][Date Wed, 03 Aug 2005 11:33:30 PDT]/UNNAMED/[From "Ariana Johnson" <a ... ... /[From "Mary Garner" <[removed]>][Date Sat, 6 Aug 2005 18:42:20 +0100]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text/[From Joshua Layla <[removed]>][Date Thu, 28 Jul 2005 11:36:54 -0700]/UNNAMED/[From "Steve Robinson" <[removed]>][Date Wed, 3 Aug 2005 18:55:24 +0100]/text/[From [removed]][Date Wed, 03 Aug 2005 11:33:30 PDT]/UNNAMED/[From "Ariana Johnson" <a ... /[ . ... /[From "Marvin Pacheco" <[removed]>][Date Fri, 05 Aug 2005 13:35:14 -0700]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text/[From Joshua Layla <[removed]>][Date Thu, 28 Jul 2005 11:36:54 -0700]/UNNAMED/[From "Steve Robinson" <[removed]>][Date Wed, 3 Aug 2005 18:55:24 +0100]/text/[From [removed]][Date Wed, 03 Aug 2005 11:33:30 PDT]/UNNAMED/[From "Ariana Johnson" <a ... /[ ... /[From "John" <[removed]>][Date Thu, 4 Aug 2005 23:12:53 +0100]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text/[From Joshua Layla <[removed]>][Date Thu, 28 Jul 2005 11:36:54 -0700]/UNNAMED/[From "Steve Robinson" <[removed]>][Date Wed, 3 Aug 2005 18:55:24 +0100]/text/[From [removed]][Date Wed, 03 Aug 2005 11:33:30 PDT]/UNNAMED/[From "Ariana Johnson" <a ... /[From "[removed]" <[removed]>][Date Thu, 04 Aug 2005 00:46:58 -0700]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text/[From Joshua Layla <[removed]>][Date Thu, 28 Jul 2005 11:36:54 -0700]/UNNAMED/[From "Steve Robinson" <[removed]>][Date Wed, 3 Aug 2005 18:55:24 +0100]/text/[From [removed]][Date Wed, 03 Aug 2005 11:33:30 PDT]/UNNAMED/[From "Ariana Johnson" <[removed]>][Date Thu, 4 Aug 2005 00:01:16 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text/[From Joshua Layla <[removed]>][Date Thu, 28 Jul 2005 11:36:54 -0700]/UNNAMED/[From "Steve Robinson" <[removed]>][Date Wed, 3 Aug 2005 18:55:24 +0100]/text/[From [removed]][Date Wed, 03 Aug 2005 11:33:30 PDT]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text/[From Joshua Layla <[removed]>][Date Thu, 28 Jul 2005 11:36:54 -0700]/UNNAMED/[From "Steve Robinson" <[removed]>][Date Wed, 3 Aug 2005 18:55:24 +0100]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text/[From Joshua Layla <[removed]>][Date Thu, 28 Jul 2005 11:36:54 -0700]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fi . ... /[From "Julian Ge ... /[From <[removed]>][Date Mon, 05 Dec 2005 21:51:4 ... /gsbill.exe Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fi . ... /[From "Julian Ge ... /[From <[removed]>][Date Mon, 05 Dec 2005 21:51:43 + ... /UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fi . ... /[From "Julian Ge ... /[From <[removed]>][Date Mon, 05 Dec 2005 21:51:43 +0800]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fi . ... /[From "Julian Geiger" <[removed]>][Date Mon, 05 Dec 2005 09:44:03 -0400]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fi ... /[From "E ... /[From "tracey cope" <[removed]>][Date Mon, 05 Dec 2005 15:07:18 +0000]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fi ... /[From "Earthenware F. Stagnated" <[removed]>][Date Mon, 05 Dec 2005 07:52:21 -0500]/text Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fin . ... /[From "Lanny B. England" <[removed]>][Date Mon, 05 Dec 2005 15:31:33 +0500]/text Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fin ... /[Fro ... /[From "Jimmie Brown" <[removed]>][Date Sun, 04 Dec 2005 22:55:48 -0500]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fin ... /[From ... /[From "Stacey Prather" <[removed]>][Date Sun, 4 2005 20:55:36 -0060]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fin ... /[From ... /[From "Ramona Beaver" <[removed]>][Date Mon, 05 Dec 2005 00:42:33 -0800]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <fin ... /[From "Maryellen Bowen" <[removed]>][Date Sun, 04 Dec 2005 02:34:40 -0800]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@ ... /[From "bethel Kinney" <[removed]>][Date Sun, 04 Dec 2005 02:13:21 -0400]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@m ... /[ ... /[From "Gaizka Dewall" <[removed]>][Date Sat, 3 Dec 2005 20:26:24 -0500]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@m ... /[From "Fumiko Hendrickson" <[removed]>][Date Sat, 03 Dec 2005 16:48:10 -0600]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@m ... /[From "Janna Tatum" <[removed]>][Date Sat, 03 Dec 2005 17:31:19 -0500]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@m ... /[From ... /[From "Tim J. Bird" <[removed]>][Date Sat, 03 Dec 2005 23:58:25 +0700]/text Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@m ... /[From ... /[From "ALLSHOUSE" <[removed]>][Date Sat, 03 Dec 2005 19:49:52 +0900]/text Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@m ... /[From "Lawanda Petty" <[removed]>][Date Sat, 03 Dec 2005 04:02:37 -0500]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@mail-re . ... /[From "Dino Kaufman" <[removed]>][Date Fri, 02 Dec 2005 19:15:25 -050 ... /text Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@mail-re . ... /[From "Dino Kaufman" <[removed]>][Date Fri, 02 Dec 2005 19:15:25 -0500]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <finance@mail-re ... /[From "Tracy Parra" <[removed]>][Date Sat, 03 Dec 2005 01:59:10 +0500]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Motor Car Credit" <[removed]>][Date Fri, 02 Dec 2005 22:04:46 +0600]/html Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Jimmie Werner" <Stephan.Ree ... /[From "Jana K. Pickett" <[removed]>][Date Mon, 05 Dec 2005 19:11:21 ... /qform.exe Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Jimmie Werner" <Stephan.Ree ... /[From "Jana K. Pickett" <[removed]>][Date Mon, 05 Dec 2005 19:11:21 +0000]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Jimmie Werner" <Stephan.Ree ... /[From "Arnulfo Lindsey" <[removed]>][Date Mon, 05 Dec 2005 11:37:09 -0600]/text Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text/[From "Jimmie Werner" <[removed]>][Date Mon, 05 Dec 2005 12:13:45 -0500]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED/[From "[removed]" <[removed]>][Date Wed, 9 Nov 2005 19:42:44 -0600]/text Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED/[From "ruth" <[removed]>][Date Wed, 9 Nov 2005 20:49:48 -0000]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED/[From "Llywelyn Saad" <[removed]>][Date Wed, 9 Nov 2005 11:28:07 -0500]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]/UNNAMED Infected: Trojan-Proxy.Win32.Agent.hx skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED/[From Tanner Conant <[removed]>][Date Thu, 9 Feb 2006 22:50:13 -0800 (PST)]/text/[From "Monty Gray" <[removed]>][Date Fri, 10 Feb 2006 02:12:49 -0600]/text/[From ... /[From Argyle Wainscott <[removed]>][Date Sun, 12 Feb 2006 12:56:55 -0800 (PST)]/html Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED/[From Tanner Conant <[removed]>][Date Thu, 9 Feb 2006 22:50:13 -0800 (PST)]/text/[From "Monty Gray" <[removed]>][Date Fri, 10 Feb 20 ... /[From Research Opinio ... /[From "service@paypa ... /[From [removed]][Date Mon, 13 Feb 2006 13:35:47 -0500]/html Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED/[From Tanner Conant <[removed]>][Date Thu, 9 Feb 2006 22:50:13 -0800 (PST)]/text/[From "Monty Gray" <[removed]>][Date Fri, 10 Feb 20 ... /[From Research Opinio ... /[From "[removed]" <[removed]>][Date Mon, 13 Feb 2006 09:18:13 -0800]/UNNAMED Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED/[From Tanner Conant <[removed]>][Date Thu, 9 Feb 2006 22:50:13 -0800 (PST)]/text/[From "Monty Gray" <[removed]>][Date Fri, 10 Feb 20 ... /[From Research Opinion Poll and emailinform <[removed]>][Date Mon, 13 Feb 2006 15:20:44 +0100 (CET)]/UNNAMED Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED/[From Tanner Conant <[removed]>][Date Thu, 9 Feb 2006 22:50:13 -0800 (PST)]/text/[From "Monty Gray" <[removed]>][Date Fri, 10 Feb 2006 02:12:49 -0600]/text/[From "eBay ... /[From "Frank Clement" <[removed]>][Date Mon, 13 Feb 2006 04:54:01 -0600]/UNNAMED Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED/[From Tanner Conant <[removed]>][Date Thu, 9 Feb 2006 22:50:13 -0800 (PST)]/text/[From "Monty Gray" <[removed]>][Date Fri, 10 Feb 2006 02:12:49 -0600]/text/[From "eBay Member: ... /[From [removed]][Date Mon, 13 Feb 2006 18:00:19 +0100]/text Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED/[From Tanner Conant <[removed]>][Date Thu, 9 Feb 2006 22:50:13 -0800 (PST)]/text/[From "Monty Gray" <[removed]>][Date Fri, 10 Feb 2006 02:12:49 -0600]/text/[From "eBay Member: little.red.attic" <[removed]>][Date Fri, 10 Feb 2006 11:56:25 -0800]/UNNAMED Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED/[From Tanner Conant <[removed]>][Date Thu, 9 Feb 2006 22:50:13 -0800 (PST)]/text/[From "Monty Gray" <[removed]>][Date Fri, 10 Feb 2006 02:12:49 -0600]/text Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED/[From Tanner Conant <[removed]>][Date Thu, 9 Feb 2006 22:50:13 -0800 (PST)]/text Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text/[From Team Fusion at Website Pros <[removed]>][Date Thu, 9 Feb 2006 09:07:49 -0500 (EST)]/UNNAMED Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]/text Infected: Trojan-Downloader.HTML.Agent.ae skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New Engla ... /[From "K ... /[From eBay Member budgetsavers <[removed]>][Date Mon, 13 Mar 2006 21:54:23 +0200]/text Infected: Trojan-Dropper.Win32.Small.anc skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New Engla ... /[From "K ... /[From "Staterooms D. Casals" <[removed]>][Date Tue, 14 Mar 2006 13:14:28 -0500]/text Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New Engla ... /[From "K .. ... /[From ... /[From <[removed]>][Date Tue, 14 Mar 2006 21:40:52 -0500]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New Engla ... /[From "K .. ... /[From "Roxio"<[removed]>][Date Mon, 13 Mar 2006 02:06:51 -0500 (EST)]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New Engla ... /[From "K ... /[From "Duncan Barua" <[removed]>][Date Mon, 13 Mar 2006 08:51:52 -0800]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New Engla ... /[From "Ki ... /[From "Pearce, Rolfe" <[removed]>][Date Mon, 13 Mar 2006 11:10:11 -0000]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New Engla ... /[From "Kimber ... /[From "LEONE" <[removed]>][Date Sat, 11 Mar 2006 13:08:16 -0500]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New Engla ... /[From "Kimberly Cardenas" <[removed]>][Date Mon, 13 Mar 2006 13:17:27 +0100]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New Engla ... /[From "Home Business Recruiter" [removed]][Date Sun, 12 Mar 2006 23:11:48 GMT]/html Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New England Co ... /[From Op ... ... /[From "Trenton" <[removed]>][Date Sat, 11 Mar 2006 20:30:42 +0400]/text Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New England Co ... /[From Op ... /[From Nectar Helpline <[removed]>][Date Fri, 10 Mar 2006 16:53:29 GMT]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New England Co ... /[From Opodo <[removed]>][Date Fri, 10 Mar 2006 17:02:43 +0000 (GMT)]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED/[From "New England Country Homes" <[removed]>][Date 10 Mar 2006 11:33:23 -0000]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED/[From "Vicki Mallard" <[removed]>][Date Thu, 9 Mar 2006 07:09:14 -0500]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text/[From "thomsonfly.com" <[removed]>][Date Thu, 9 Mar 2006 11:08:53 -0600]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED/[From "Amanda" <[removed]>][Date Wed, 08 Mar 2006 21:15:22 -0900]/text Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]/UNNAMED Infected: Trojan-Dropper.Win32.Delf.tw skipped
C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox MailBerkeleymboxx: infected - 234, suspicious - 51 skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED ... /[ ... /[From ... /[From [removed]][Date Tue, 14 Dec 2004 21:28:01 +0000]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED ... /[ ... /[From "Hsbq.Ortega" <[removed]>][Date Tue, 14 Dec 2004 22:43:31 +0400]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED ... /[ ... /[From "Kelsey Finch" <[removed]>][Date Tue, 14 Dec 2004 13:32:02 -0500]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED ... /[From Griselda Colette <[removed]>][Date Tue, 14 Dec 2004 09:56:18 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED/[From Trent Von <[removed]>][Date Tue, 14 Dec 2004 08:41:46 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html/[From "Mrs Hollis" <[removed]>][Date Tue, 14 Dec 2004 17:23:34 +0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From princess jan ajana <[removed]>][Date Tue, 14 Dec 2004 00:41:36 GMT]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html/[From "L .. ... /[From Wamu online support <[removed]>][Date Wed, 15 Dec 2004 16:01:57 +0000]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html/[From "L ... /[From Napster Replacement <[removed]>][Date Thu, 16 Dec 2004 07:50:00 +0300]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html/[From "L ... /[From "Ebbz.Chase" <[removed]>][Date Wed, 15 Dec 2004 04:44:26 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html/[From "Looped I. Buckboards" <[removed]>][Date Wed, 15 Dec 2004 05:15:04 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED/[From Lon Whitman <[removed]>][Date Wed, 15 Dec 2004 11:48:40 +0400 (CST)]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html/[From =?utf-8?q?Saiseri?= <[removed]>][Date Wed, 15 Dec 2004 03:10:48 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED/[From "Courtney Wiley" <[removed]>][Date Fri, 10 Dec 2004 19:18:26 -0600]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 .. ... /[From [removed]][Date Fri, 24 Dec 2004 16:24:22 +0000]/html Infected: Trojan-Spy.HTML.Bankfraud.bv skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 ... /[From "Fraud Prevention Department" <[removed]>][Date Fri, 24 Dec 2004 12:05:00 +0000]/html Infected: Trojan-Spy.HTML.Bankfraud.bv skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... /[F ... /[F ... /[From West Banking Dept <[removed]>][Date Mon, 27 Dec 2004 17:38:40 +0000]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... /[ ... /[Fro ... /[From West Card Dept <[removed]>][Date Tue, 28 Dec 2004 07:50:34 +0000]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... /[ ... /[From "Replicas" <[removed]>][Date Mon, 27 Dec 2004 22:54:12 -0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... /[ ... /[From "Trisha Evans" <[removed]>][Date Mon, 27 Dec 2004 11:23:59 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... /[F ... /[From "Kbay.Singh" <[removed]>][Date Mon, 27 Dec 2004 05:17:09 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... /[From =?utf-8?q?Benny Glr?= <[removed]>][Date Mon, 27 Dec 2004 02:41:11 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... / ... ... /[From Al ... /[From "Horace" <[removed]>][Date Mon, 27 Dec 2004 02:18:05 +0400]/html Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... / ... ... /[From Alicia Janel <[removed]>][Date Sun, 26 Dec 2004 14:32:57 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... / ... / ... /[From "Gonzalo Magee" <[removed]>][Date Sun, 26 Dec 2004 21:46:10 +0800]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... / ... /[From "Colin Starnes" <[removed]>][Date Sun, 26 Dec 2004 15:16:54 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... / .. ... /[From "Betty Dixon" <[removed]>][Date Sun, 26 Dec 2004 03:46:51 -0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... / ... /[From "Tia Staley" <[removed]>][Date Sun, 26 Dec 2004 06:24:16 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... /[ ... /[From "Jeanette Stone" <[removed]>][Date Sat, 25 Dec 2004 10:45:37 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 + ... /[From =?utf-8?q?Emma Htpore?= <[removed]>][Date Sat, 25 Dec 2004 17:05:01 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0 ... /[From "Patience Vanessa" <[removed]>][Date Sat, 25 Dec 2004 06:42:44 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 .. . ... /[From "Kimmy Ross" <[removed]>][Date Sat, 25 Dec 2004 06:42:41 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 .. ... /[From Music Download Newsletter <[removed]>][Date Sat, 25 Dec 2004 09:18:21 +0600]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 ... /[ ... /[ ... /[From "Elsa John" <[removed]>][Date Fri, 24 Dec 2004 17:19:10 -0100]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 ... /[ ... /[From "Virgie Pickett" <[removed]>][Date Fri, 24 Dec 2004 05:58:38 -0400]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 ... /[From "Tamika Crockett" <[removed]>][Date Fri, 24 Dec 2004 14:04:46 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 ... /[From "Cheating wives " <[removed]>][Date Fri, 24 Dec 2004 02:37:59 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From "Frances Story" <[removed]>][Date Fri, 24 Dec 2004 09:09:04 -0300]/text Infected: Trojan-Spy.HTML.Bankfraud.aq skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 ... /[From "[removed]" <[removed]>][Date Tue, 18 Jan 2005 06:59:18 -010 ... /html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +02 ... /[From "[removed]" <[removed]>][Date Tue, 18 Jan 2005 06:59:18 -0100]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. ... ... /[From "Margret Steve" <[removed]>][Date Mon, 17 Jan 2005 14:20:06 -0700]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. ... /[Fr ... /[From "Toby" <[removed]>][Date Mon, 17 Jan 2005 09:34:44 -0800]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. ... /[From "Hugh Roman" <[removed]>][Date Tue, 18 Jan 2005 10:51:07 +0300]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. ... ... /[From "Gregory Dean" <[removed]>][Date Mon, 17 Jan 2005 13:43:06 -0300]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. ... /[From "Jean Bartley" <[removed]>][Date Mon, 17 Jan 2005 12:15:41 -0200]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. ... /[From "Ulric Lester" <[removed]>][Date Mon, 17 Jan 2005 08:02:17 -0600]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. .. ... /[From "Major Freeman" <[removed]>][Date Mon, 17 Jan 2005 08:02:03 -0600]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. .. ... /[From "Patti S. Barrett" <[removed]>][Date Mon, 17 Jan 2005 06:03:28 -0600]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. .. ... /[From "Sidney Swartz" <[removed]>][Date Mon, 17 Jan 2005 13:14:28 -0100]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 .. ... /[From "Tonia Childs" <[removed]>][Date Mon, 17 Jan 2005 21:03:00 -0700]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 ... /[Fr ... /[From "Kareem" <[removed]>][Date Mon, 17 Jan 2005 07:48:58 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 ... /[From " ... /[From Ernest Baldwin <[removed]>][Date Mon, 17 Jan 2005 10:25:46 -0100]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 ... /[From "Brandy Greer" <[removed]>][Date Mon, 17 Jan 2005 06:09:17 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200 ... /[From "Cameron Denton" <[removed]>][Date Mon, 17 Jan 2005 06:09:08 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED/[From Prince Akins][Date Mon, 17 Jan 2005 10:38:26 +0000]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED/[From "Terrie Daley" <[removed]>][Date Fri, 17 Dec 2004 15:23:48 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED/[From "Reciting H. Realization" <[removed]>][Date Fri, 17 Dec 2004 02:28:53 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED/[From "Elias Rivera" <[removed]>][Date Fri, 17 Dec 2004 03:47:28 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean ... /[Fro ... /[From "Francis Jacobson" <[removed]>][Date Sun, 13 Feb 2005 21:29:43 - .. ... /text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean ... /[Fro ... /[From "Francis Jacobson" <[removed]>][Date Sun, 13 Feb 2005 21:29:43 - ... /UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean ... /[Fro ... /[From "Francis Jacobson" <[removed]>][Date Sun, 13 Feb 2005 21:29:43 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean ... /[From =?utf-8?q?Ra ... /[From "keromail.com" <[removed]>][Date Thu, 10 Feb 2005 03:30:12 -0800]/text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean ... /[From =?utf-8?q?Ranald Xaumedhs?= <[removed]>][Date Thu, 10 Feb 2005 10:23:32 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonou ... / ... /[From "Ned Geoff" <[removed]>][Date Thu, 10 Feb 2005 02:39:23 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonou ... /[From " ... /[From "Kerry Tatum" <[removed]>][Date Thu, 10 Feb 2005 00:34:52 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonou ... /[From "butterfield Cross" <[removed]>][Date Thu, 10 Feb 2005 00:23:23 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough ... ... ... /[From "Ronna Jacquetta" <[removed]>][Date Thu, 10 Feb 2005 00:30:46 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough ... ... /[From "Silvia Madden" <[removed] >][Date Thu, 10 Feb 2005 05:04:35 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough ... /[From "Randall Hudson" <[removed]>][Date Wed, 09 Feb 2005 20:24:07 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <hqagq ... /[ ... /[From Donna Ritter <[removed]>][Date Thu, 10 Feb 2005 01:10:13 +0200]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <hqagq ... /[From "Sam Cartwright" <[removed]>][Date Wed, 09 Feb 2005 17:08:24 -0600]/text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED/[From "Sean Mcdonough" <[removed]>][Date Wed, 09 Feb 2005 15:56:20 -0700]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text/[From "Hecht Randi"<[removed]>][Date mié, 09 feb 2005 22:44:37 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED/[From "Lyman Colon" <[removed]>][Date Wed, 09 Feb 2005 17:51:27 -0300]/text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Andre" <[removed]>][Date Wed, 09 Feb 2005 11:12:43 -0500]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700 ... / ... /[From [removed]][Date Fri, 18 Feb 2005 11:46:37 -060 ... /html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700 ... / ... /[From [removed]][Date Fri, 18 Feb 2005 11:46:37 -0600]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700 ... /[From "Brenda Sprague" <[removed]>][Date Fri, 18 Feb 2005 07:30:18 -0700]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700 ... /[From "Janelle Lynch" <[removed]>][Date Fri, 18 Feb 2005 13:52:55 +0000]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700 ... /[Fro ... /[From "Mari Mahoney" <[removed]>][Date Fri, 18 Feb 2005 10:46:33 -0300]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700 ... /[From "Aviation P. Perfumes" <[removed]>][Date Fri, 18 Feb 2005 05:14:41 -0800]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700] ... /[From "Tro S. Valine" <[removed]>][Date Fri, 18 Feb 2005 03:51:20 -0800]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text/[From Alexandra Watts <[removed]>][Date Fri, 18 Feb 2005 06:21:43 -0500]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html/[From "Walker ." <[removed]>][Date Fri, 18 Feb 2005 01:49:01 -0700]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From "[removed]" <[removed]>][Date Fri, 18 Feb 2005 00:31:20 -0800]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From ... /[From Washington Mutual Support <[removed]>][Date Sun, 20 Feb 2005 16:05:55 + .. ... /text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From ... /[From Washington Mutual Support <[removed]>][Date Sun, 20 Feb 2005 16:05:55 + .. ... /html Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From ... /[From Washington Mutual Support <[removed]>][Date Sun, 20 Feb 2005 16:05:55 + ... /UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From ... /[From Washington Mutual Support <[removed]>][Date Sun, 20 Feb 2005 16:05:55 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From "Heidi Wil ... /[From "Ella Judd" <[removed]>][Date Sun, 20 Feb 2005 05:41:29 -0600]/text Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED/[From "Heidi Wilkie" <[removed]>][Date Sun, 20 Feb 2005 09:02:41 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html/[From "Katie Whitaker" <[removed]>][Date Sun, 20 Feb 2005 09:02:37 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Sun, 20 Feb 2005 05:59:06 -0700]/html Infected: Trojan-Spy.HTML.Wamufraud.au skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[F ... /[Fro ... /[From Ebay.com Security Team <[removed]>][Date 1 Mar 2005 04:06:2 ... /UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[F ... /[Fro ... /[From Ebay.com Security Team <[removed]>][Date 1 Mar 2005 04:06:24 -0000]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[F ... /[From "Larl ... /[From "Megan Molina" <[removed]>][Date 14 Feb 2005 06:36:10 -0700]/text Suspicious: Trojan-Spy.HTML.Fraud.gen skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37 ... /[From "=?iso-8859-1?B?Rn ... /[From Halifax bank <[removed]>][Date Tue, 01 Mar 2005 15:57:22 +0400]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37 ... /[From "=?iso-8859-1?B?RnJlc2hsaXZpbmcuY29t?="<[removed]>][Date Mon, 28 Feb 2005 21:21:31 +0000 (GMT)]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNA ... /[From "Adult Offers" <[removed]>][Date Mon, 28 Feb 2005 22:46:10 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[F ... /[Fr ... /[From Janessa Gwen <[removed]>][Date Mon, 28 Feb 2005 22:18:55 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[F ... /[From "Larles Q. Bill" <[removed]>][Date Mon, 28 Feb 2005 17:32:06 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[Fr ... /[F ... /[From "Sean Smith" <[removed]>][Date Mon, 28 Feb 2005 23:02:50 +0100]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[Fr ... /[From "Griffin Braxton" <[removed]>][Date Mon, 28 Feb 2005 15:28:24 -0600]/text Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[Fro ... ... /[From Freeman Dawson <[removed]>][Date Mon, 28 Feb 2005 11:21:11 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[Fro ... /[From "Hallie Brennan" <[removed]>][Date Mon, 28 Feb 2005 12:19:58 -0600]/text Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From " ... /[From "Wilfred Fitzroy" <[removed]>][Date Mon, 28 Feb 2005 12:19:55 -0600]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Ti ... /[From ... /[From "Dr. A. Yoder" <[removed]>][Date Mon, 28 Feb 2005 10:14:30 -0800]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Ti ... /[From " ... /[From "Martiniere" <[removed]>][Date Mon, 28 Feb 2005 23:24:17 +0500]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Ti ... /[From "bl . ... /[From "Ethan Hardy" <[removed]>][Date Mon, 28 Feb 2005 12:33:59 -0600]/text Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Ti ... /[From "bl ... /[From "Landon Maloney" <[removed]>][Date Mon, 28 Feb 2005 19:36:45 +0300]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Ti ... /[From "bloomington Shultz" <[removed]>][Date Fri, 25 Feb 2005 02:22:32 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie San ... /[From ... /[From "Geffen Wendy"<[removed]>][Date Thu, 24 Feb 2005 22:32:41 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie San ... /[From Bernardo Quinones <[removed]>][Date Fri, 25 Feb 2005 07:03:24 +0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED/[From "Tillie Santos" <[removed]>][Date Fri, 25 Feb 2005 04:39:16 -0100]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html/[From "Tyson Le" <[removed]>][Date Fri, 25 Feb 2005 08:37:17 +0300]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html/[From <[removed]>][Date Fri, 25 Feb 2005 13:08:54 +0800]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED/[From "Alfonso Tyler" <[removed]>][Date Mon, 14 Feb 2005 21:26:55 +0400]/html Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]/UNNAMED Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Inbox Infected: Trojan-Spy.HTML.Bankfraud.hs skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 ... /[From "Adult ... /[From " ... /[From Microsoft <[removed]>][Date Sun, 06 Mar 2005 14:19:48 +0000]/UNNAMED Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 ... /[From "Adult ... /[From "Dr. E ... /[From Tihonov <[removed]>][Date Sun, 06 Mar 2005 11:39:39 +0000]/html Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 ... /[From "Adult ... /[From "Dr. E. Coffey" <[removed]>][Date Sun, 06 Mar 2005 03:16:20 -0800]/UNNAMED Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 ... /[From "Adult Offer ... ... /[From "Rosa Lam" <[removed]>][Date Sat, 05 Mar 2005 17:18:25 -0800]/UNNAMED Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 ... /[From "Adult Offer ... /[From "Hillary Mills" <[removed]>][Date Sun, 06 Mar 2005 11:33:55 +0500]/UNNAMED Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 ... /[From "Adult Offers" <[removed]>][Date Sat, 5 Mar 2005 19:52:21 -0800]/UNNAMED Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 +0600]/text/[From " ... /[Fr ... ... /[From "Reyes Valentine" <[removed]>][Date 14 Feb 2005 06:36:10 -0700]/text Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 +0600]/text/[From " ... /[Fr ... /[From "Jersakova Zaneta" <[removed]>][Date Sat, 05 Mar 2005 06:54:28 -0300]/UNNAMED Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 +0600]/text/[From " ... /[From "Laurel Overton" <[removed]>][Date Fri, 25 Feb 2005 23:09:33 +0000]/text Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 +0600]/text/[From "Loren ... /[From "Irma Mcgowan" <[removed]>][Date Sat, 26 Feb 2005 08:54:36 -0600]/UNNAMED Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 +0600]/text/[From "Lorene Taylor" <[removed]>][Date Fri, 25 Feb 2005 14:23:23 -0800]/UNNAMED Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 +0600]/text Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk Infected: Trojan.Win32.Small.dc skipped
C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv ZIP: infected - 105, suspicious - 30 skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash/[From You've received a message from an eBay member][Date Thu, 17 Apr 2008 19:10:52 -0700 (GMT)]/UNNAMED/[From "eBay Member: jodik9772" <[removed]>][Date Mon, 21 Apr 2008 16:47:59 -0700 (GMT)]/UNNAMED/[From [removed]][Date Tue, 22 Apr 2008 13:15:12 UT]/text/[From "Anita Pachot" <[removed]>][Date Thu, 1 May 2008 16:58:08 +093 ... /[From ... /[From "Dorthy Brennan" <[removed]>][Date Sun, 4 May 2008 12:10:10 - ... /x-saver.exe Infected: Trojan-Downloader.Win32.Agent.odk skipped
C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash/[From You've received a message from an eBay member][Date Thu, 17 Apr 2008 19:10:52 -0700 (GMT)]/UNNAMED/[From "eBay Member: jodik9772" <[removed]>][Date Mon, 21 Apr 2008 16:47:59 -0700 (GMT)]/UNNAMED/[From [removed]][Date Tue, 22 Apr 2008 13:15:12 UT]/text/[From "Anita Pachot" <[removed]>][Date Thu, 1 May 2008 16:58:08 +093 ... /[From ... /[From "Dorthy Brennan" <[removed]>][Date Sun, 4 May 2008 12:10:10 -0500]/x-saver.zip Infected: Trojan-Downloader.Win32.Agent.odk skipped
C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash/[From You've received a message from an eBay member][Date Thu, 17 Apr 2008 19:10:52 -0700 (GMT)]/UNNAMED/[From "eBay Member: jodik9772" <[removed]>][Date Mon, 21 Apr 2008 16:47:59 -0700 (GMT)]/UNNAMED/[From [removed]][Date Tue, 22 Apr 2008 13:15:12 UT]/text/[From "Anita Pachot" <[removed]>][Date Thu, 1 May 2008 16:58:08 +093 ... /[From "A ... /[From "[removed]" <[removed]>][Date Thu, 1 May 2008 20:01:49 +0200 (CEST)]/UNNAMED Infected: Trojan-Downloader.Win32.Agent.odk skipped
C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash/[From You've received a message from an eBay member][Date Thu, 17 Apr 2008 19:10:52 -0700 (GMT)]/UNNAMED/[From "eBay Member: jodik9772" <[removed]>][Date Mon, 21 Apr 2008 16:47:59 -0700 (GMT)]/UNNAMED/[From [removed]][Date Tue, 22 Apr 2008 13:15:12 UT]/text/[From "Anita Pachot" <[removed]>][Date Thu, 1 May 2008 16:58:08 +093 ... /[From "Anita Pachot" <[removed]>][Date Thu, 1 May 2008 18:10:06 +0930 (Cen. Australia Standard Time)]/UNNAMED Infected: Trojan-Downloader.Win32.Agent.odk skipped
C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash/[From You've received a message from an eBay member][Date Thu, 17 Apr 2008 19:10:52 -0700 (GMT)]/UNNAMED/[From "eBay Member: jodik9772" <[removed]>][Date Mon, 21 Apr 2008 16:47:59 -0700 (GMT)]/UNNAMED/[From [removed]][Date Tue, 22 Apr 2008 13:15:12 UT]/text/[From "Anita Pachot" <[removed]>][Date Thu, 1 May 2008 16:58:08 +0930 (Cen. Australia Standard Time)]/UNNAMED Infected: Trojan-Downloader.Win32.Agent.odk skipped
C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash/[From You've received a message from an eBay member][Date Thu, 17 Apr 2008 19:10:52 -0700 (GMT)]/UNNAMED/[From "eBay Member: jodik9772" <[removed]>][Date Mon, 21 Apr 2008 16:47:59 -0700 (GMT)]/UNNAMED/[From [removed]][Date Tue, 22 Apr 2008 13:15:12 UT]/text Infected: Trojan-Downloader.Win32.Agent.odk skipped
C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash/[From You've received a message from an eBay member][Date Thu, 17 Apr 2008 19:10:52 -0700 (GMT)]/UNNAMED/[From "eBay Member: jodik9772" <[removed]>][Date Mon, 21 Apr 2008 16:47:59 -0700 (GMT)]/UNNAMED Infected: Trojan-Downloader.Win32.Agent.odk skipped
C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash/[From You've received a message from an eBay member][Date Thu, 17 Apr 2008 19:10:52 -0700 (GMT)]/UNNAMED Infected: Trojan-Downloader.Win32.Agent.odk skipped
C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash MailBerkeleymboxx: infected - 8 skipped
C:\Documents and Settings\Dave Garner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Dave Garner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Dave Garner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Dave Garner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dave Garner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Dave Garner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dave Garner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Dave Garner\NtUser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\moved\efcAPJbA.dll Infected: Trojan.Win32.Monder.gen skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\chandir.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\chandir.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\chn.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\chn.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\D0000000.FCS Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\inuse.txt Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\L0000002.FCS Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\main.log Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs_die.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs_die.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs_dnd.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs_dnd.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs_ext.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs_ext.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs_rcv.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\prs_rcv.idx Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\storydb.dat Object is locked skipped
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Dave Garner\Data\storydb.idx Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{AA5A1458-C996-4E65-88D7-E6D1AF7B2937}\RP30\A0007247.exe Infected: Trojan.Win32.Delf.bur skipped
C:\System Volume Information\_restore{AA5A1458-C996-4E65-88D7-E6D1AF7B2937}\RP54\A0010368.dll Infected: Trojan.Win32.Monder.gen skipped
C:\System Volume Information\_restore{AA5A1458-C996-4E65-88D7-E6D1AF7B2937}\RP59\A0010669.dll Infected: Trojan.Win32.Monder.gen skipped
C:\System Volume Information\_restore{AA5A1458-C996-4E65-88D7-E6D1AF7B2937}\RP71\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_72c.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Can you delete these emails from your inbox, junk folder, and trash folder.

C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv/Mail/Local Folders/Junk/
[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g

C:\Documents and Settings\Administrator\Application Data\Thunderbird\Profiles\r7qkayd1.default\Mail\Local Folders\Inbox

/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]
/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]
/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]
/[From "Steph L"<[removed]>][Date Thu, 10 Mar 2005 15:14:29 GMT]
/[From "Waterflo" <[removed]>][Date Fri, 15 Apr 2005 08:49:36 -0900]
/[From Windsor Telecom <[removed]>][Date Thu, 12 May 2005 11:23:00 +0000]
/[From "Rowley Webber" <[removed]>][Date Wed, 8 Jun 2005 12:15:54 -0500]
/[From "Mandy McIntosh" <[removed]>][Date Wed, 13 Jul 2005 17:30:40 +0700]
/[From eBay <[removed]>][Date Wed, 9 Nov 2005 06:26:34 PST]
/[From msn.com Sender, but not from approved relay.][Date Thu, 09 Feb 2006 08:18:19 -0200]
/[From "Individual Italy" <[removed]>][Date 8 Mar 2006 13:58:12 -0000]

And the same here

C:\Documents and Settings\Administrator\My Documents\Thunderbird 1.0 (en) - 3.9.2005.pcv

/Mail/Local Folders/Inbox/[From "Aric Leigh" <[removed]>][Date Fri, 10 Dec 2004 20:30:10 -0600]
/Mail/Local Folders/Inbox/[From darryl <[removed]>][Date Fri, 17 Dec 2004 00:44:39 +0000]
/Mail/Local Folders/Inbox/[From Hall Santiago <[removed]>][Date Wed, 09 Feb 2005 17:47:07 +0000]
/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 ...
/Mail/Local Folders/Junk/[From wants of life, and the labors of life reduce themselves. But at my back I always hear Time's winged chariot hurrying near. You can only find truth with logic if you have already found truth without it. I would like to believe when I die that I have g/[From "Danielle Burris" <[removed]>][Date Sat, 26 Feb 2005 02:55:43 +0600]

C:\Documents and Settings\Dave Garner\Application Data\Thunderbird\Profiles\6r6ali75.default\Mail\Local Folders\Trash
/[From You've received a message from an eBay member][Date Thu, 17 Apr 2008 19:10:52 -0700 (GMT)]


Then locate and delete:
C:\Program Files\Alwil Software\Avast4\DATA\moved\efcAPJbA.dll << This file