Trojans Virus Help please!

Muppet81

Last night I was searching for an innocent website but by accident went on to one that was far from innocent. I quickly came out of it but soon after Windows security Centre alert appeared to say that my PC was being attacked by over 300 trojans and several virus. I blocked everyhting that appeared and then ran my McAfee AV scan. It came up clean and i was very relieved.

I then continued with booking a flight using my credit card as i thought my PC was clean.

This morning I researched into trojans and was horrified to find that McAfee often fails to pick these up and I saw recommendations to download EMSI A-squared free malware. I did this and have just run a scan.
:eek:

There is a massive list of trojans, worms, virus.

Many are low risk tracking cookies

There are some medium risk which are all start with Trace Directory Starware

There are some high risk -

VirusWin32.Trojan!IK 1 file
Trojan.win32.VBIK - 1 file
Trojan Win32Patched!IK 1 file
BackdoorWin32.Netcontrol!IK 1 file
WormWi.Win32.Mefir!IK 89 files

I quarantined the high risk ones and then the medium but stupidly then , as I noticed hewlet packard against one file restored the medium risk files, thinking they would just go back into the scan list. No, they have gone back on my PC so I will need to rerun the scan to pick these up again.

This is the first time I have ever had a problem and I am worried sick especially as I used my credit card last night and I use Firefox on my PC to do my banking.

Can anyone please offer any help to a total novice on these things.

I will wait a little while to see if anyone comes back but then will have to rerun the scan which will take several hours to pick up the medium risks again.

kippen_noedel

run your scans in safe mode, when you think it's clean run hijackthis and post a log

alanrowell

start with the Malware/Spyware Removal Guide sticky thread at the top of this forum

aliEnRIK

Download MALWAREBYTES (Click 'DOWNLOAD NOW')
http://www.download.com/Malwarebytes-Anti-Malware/3000-18510_4-10804572.html?cdlPid=10997763
UPDATE and FULL scan
Post the log here after its deleted everything

Download HIJACK THIS (Click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
reboot
SCAN and post the log so we can see whats running

Muppet81

Hi Alienrik,

I read the posts about malware/spyware and do not feel that I am competent to try all that is mentioned. Having been made redundant lately going to an expert is not an option at the moment.

Just before I do the download of the two programmes you mention, please could you look at the last (short) report I ran using a-squared and tell me if you think I still need to?

When I first ran this yesterday there were hundreds of problems some low risk (cookies), some medium and some high. I went to delete all. There was just 1 which I got a message for saying that it could not be deleted - Trace.Directory.Starware 4.0.0.0!A2

I also deleted all my cookies and temp files on IE8.

I then received 55 e-mails, 1 of which went into my Outlook folder and 54 which went straight to my Spamhilator folder and were deleted without opening.

I then ran the a-squared scan again overnight. The file which apparantly could not be removed did not get picked up but 5 new Trace. Directory files were picked up. Being a dumb blonde I do not know the significance of these. Could they be generated from e-mails received in Spamhilator? As I thought I had just removed all my cookies wondered how a-squared came to scan 312 of the little blighters!

Very happy to try using Malwarebytes and Hijack this if you think it is necessary but I just worry that the more I do, the more chance there is of me messing something up.

a-squared Free - Version 4.5
Last update: 30/06/2009 09:04:57
Scan settings:
Scan type: Deep Scan
Objects: Memory, Traces, Cookies, C:\
Scan archives: On
Heuristics: Off
ADS Scan: On
Scan start: 30/06/2009 22:49:10
C:\Documents and Settings\Hall\Cookies\hall@advertising[2].txt detected: Trace.TrackingCookie.advertising!A2
C:\Documents and Settings\Hall\Cookies\hall@doubleclick[1].txt detected: Trace.TrackingCookie.doubleclick!A2
C:\Documents and Settings\Hall\Cookies\hall@statcounter[1].txt detected: Trace.TrackingCookie.statcounter!A2
C:\Documents and Settings\Hall\Cookies\hall@statse.webtrendslive[1].txt detected: Trace.TrackingCookie.statse.webtrendslive!A2
C:\Documents and Settings\Hall\Cookies\hall@tribalfusion[2].txt detected: Trace.TrackingCookie.tribalfusion!A2
Scanned
Files: 129316
Traces: 667430
Cookies: 312
Processes: 45
Found
Files: 0
Traces: 0
Cookies: 5
Processes: 0
Registry keys: 0
Scan end: 01/07/2009 01:35:55
Scan time: 2:46:45

A word from the knowledgable would be much appreaciated before I embark on another day of confusion and terror meddling in stuff I don't understand

Browntoa

those are just tracking cookies, nothing bad

Malwarebytes is safe to run , here are full instructions (print them out if need be) it will confirm if you need to do anything else and I'm around all day to post replies if need be (if you look I'm the one who wrote the Malware guide )


Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

aliEnRIK

Is there any chance you could post the log that had hundreds of problems? (Including HIGH ones)

You cant go wrong with either of the programs. Malwarebytes is safe as houses and hijack only produces a log (So long as you dont go clicking anything other than what I asked for)

Browntoa

I've got the feeling is a Vundo infection and a "false" infection display

Muppet81

Hi and thanks,

I had already decided to install Malwarebytes and run a scan but I have done the full scan. Shall I do it again on the quick scan?

The full scan has shown the following

Rogue Register Tool file 4
Adware Starware 1 file
Disable security 2 files

Will wait to hear

aliEnRIK

muppet ~ please open malwarebytes and goto LOGS and post the WHOLE log (Copy and paste)

Please also show us the a squared log I asked for

Muppet81

Here is the original report from a-sqaured - part 1

a-squared Free - Version 4.5
Last update: 30/06/2009 09:04:57
Scan settings:
Scan type: Deep Scan
Objects: Memory, Traces, Cookies, C:\
Scan archives: On
Heuristics: Off
ADS Scan: On
Scan start: 30/06/2009 09:06:07
c:\documents and settings\localservice\application data\starware detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\browsersearch detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\errorsearch detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\layouts detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\manager detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\reference detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\relatedsearch detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\searchmatch detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\toolbar detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\toolbarlogo detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\toolbarsearch detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\travelsearch detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\weather detected: Trace.Directory.Starware 4.0.0.0!A2
c:\documents and settings\localservice\application data\starware\browsersearch\browsersearch.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\browsersearch\browsersearch.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\errorsearch\errorsearchoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\errorsearch\errorsearchoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\games\gamesoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\games\gamesoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\layouts\preferenceslayout.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\layouts\preferenceslayout.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\layouts\toolbarlayout.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\layouts\toolbarlayout.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\manager\manageroptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\manager\manageroptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\movies\moviesoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\movies\moviesoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\reference\referenceoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\reference\referenceoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\relatedsearch\relatedsearchoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\relatedsearch\relatedsearchoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\screensaversmarketingsitepager\screensaversmarketingsitepageroptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\screensaversmarketingsitepager\screensaversmarketingsitepageroptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\searchassistplus\searchassistplusoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\searchassistplus\searchassistplusoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\searchmatch\searchmatchoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\searchmatch\searchmatchoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\toolbar\tbproductsoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\toolbar\tbproductsoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\toolbarlogo\toolbarlogooptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\toolbarlogo\toolbarlogooptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\toolbarsearch\toolbarsearchoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\toolbarsearch\toolbarsearchoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\travelsearch\travelsearchoptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\travelsearch\travelsearchoptions.xml.backup detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\weather\alertarchive.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\weather\weatheroptions.xml detected: Trace.File.Starware Toolbar!A2
c:\documents and settings\localservice\application data\starware\weather\weatheroptions.xml.backup detected: Trace.File.Starware Toolbar!A2
Value: HKEY_USERS\S-1-5-21-2159482509-2082524717-2123711423-1005\Software\Starware\OriginalSearchAssistant --> SearchAssistant detected: Trace.Registry.Starware 4.0.0.0!A2
Value: HKEY_USERS\S-1-5-21-2159482509-2082524717-2123711423-1005\Software\Starware\OriginalSearchAssistant --> Use Custom Search URL detected: Trace.Registry.Starware 4.0.0.0!A2
Value: HKEY_USERS\S-1-5-21-2159482509-2082524717-2123711423-1005\Software\Starware\OriginalSearchAssistant --> Use Search Asst detected: Trace.Registry.Starware 4.0.0.0!A2
Value: HKEY_USERS\S-1-5-21-2159482509-2082524717-2123711423-1005\Software\Starware\SearchAssistant --> SearchAssistant detected: Trace.Registry.Starware 4.0.0.0!A2
Value: HKEY_USERS\S-1-5-21-2159482509-2082524717-2123711423-1005\Software\Starware\SearchAssistant --> Use Custom Search URL detected: Trace.Registry.Starware 4.0.0.0!A2
Value: HKEY_USERS\S-1-5-21-2159482509-2082524717-2123711423-1005\Software\Starware\SearchAssistant --> Use Search Asst detected: Trace.Registry.Starware 4.0.0.0!A2
Value: HKEY_USERS\S-1-5-21-2159482509-2082524717-2123711423-1005\Software\Starware\Options --> ShowToolbar detected: Trace.Registry.Starware Toolbar!A2
Key: HKEY_USERS\S-1-5-21-2159482509-2082524717-2123711423-1005\software\starware detected: Trace.Registry.StarwareToolbar!A2
C:\Documents and Settings\Hall\Cookies\hall@247realmedia[1].txt detected: Trace.TrackingCookie.247realmedia!A2
C:\Documents and Settings\Hall\Cookies\hall@2o7[2].txt detected: Trace.TrackingCookie.2o7!A2
C:\Documents and Settings\Hall\Cookies\hall@about[2].txt detected: Trace.TrackingCookie.about!A2
C:\Documents and Settings\Hall\Cookies\hall@adserver.adreactor[1].txt detected: Trace.TrackingCookie.adserv!A2
C:\Documents and Settings\Hall\Cookies\hall@adserver.adtechus[1].txt detected: Trace.TrackingCookie.adserv!A2
C:\Documents and Settings\Hall\Cookies\hall@adserver.aol[2].txt detected: Trace.TrackingCookie.adserv!A2
C:\Documents and Settings\Hall\Cookies\hall@adtech[1].txt detected: Trace.TrackingCookie.adtech!A2
C:\Documents and Settings\Hall\Cookies\hall@advertising[2].txt detected: Trace.TrackingCookie.advertising!A2
C:\Documents and Settings\Hall\Cookies\hall@adviva[2].txt detected: Trace.TrackingCookie.adviva!A2
C:\Documents and Settings\Hall\Cookies\hall@atdmt[1].txt detected: Trace.TrackingCookie.atdmt!A2
C:\Documents and Settings\Hall\Cookies\hall@bizrate[2].txt detected: Trace.TrackingCookie.bizrate!A2
C:\Documents and Settings\Hall\Cookies\hall@bravenet[1].txt detected: Trace.TrackingCookie.bravenet!A2
C:\Documents and Settings\Hall\Cookies\hall@bs.serving-sys[1].txt detected: Trace.TrackingCookie.bs.serving-sys!A2
C:\Documents and Settings\Hall\Cookies\hall@casalemedia[1].txt detected: Trace.TrackingCookie.casalemedia!A2
C:\Documents and Settings\Hall\Cookies\hall@cdfreaks[2].txt detected: Trace.TrackingCookie.cdfreaks!A2
C:\Documents and Settings\Hall\Cookies\hall@cgi-bin[1].txt detected: Trace.TrackingCookie.cgi-bin[1].txt!A2
C:\Documents and Settings\Hall\Cookies\hall@clickbank[2].txt detected: Trace.TrackingCookie.clickbank!A2
C:\Documents and Settings\Hall\Cookies\hall@community.ancestry.co[2].txt detected: Trace.TrackingCookie.com!A2
C:\Documents and Settings\Hall\Cookies\hall@community.ancestry[1].txt detected: Trace.TrackingCookie.com!A2
C:\Documents and Settings\Hall\Cookies\hall@com[1].txt detected: Trace.TrackingCookie.com!A2
C:\Documents and Settings\Hall\Cookies\hall@data.coremetrics[1].txt detected: Trace.TrackingCookie.data.coremetrics!A2
C:\Documents and Settings\Hall\Cookies\hall@doubleclick[1].txt detected: Trace.TrackingCookie.doubleclick!A2
C:\Documents and Settings\Hall\Cookies\hall@fastclick[1].txt detected: Trace.TrackingCookie.fastclick!A2
C:\Documents and Settings\Hall\Cookies\hall@hitbox[2].txt detected: Trace.TrackingCookie.hitbox!A2
C:\Documents and Settings\Hall\Cookies\hall@indextools[1].txt detected: Trace.TrackingCookie.indextools!A2
C:\Documents and Settings\Hall\Cookies\hall@link[2].txt detected: Trace.TrackingCookie.link!A2
C:\Documents and Settings\Hall\Cookies\hall@media.adrevolver[1].txt detected: Trace.TrackingCookie.media!A2
C:\Documents and Settings\Hall\Cookies\hall@media.adrevolver[2].txt detected: Trace.TrackingCookie.media!A2
C:\Documents and Settings\Hall\Cookies\hall@media.intelia[1].txt detected: Trace.TrackingCookie.media!A2
C:\Documents and Settings\Hall\Cookies\hall@media6degrees[1].txt detected: Trace.TrackingCookie.media!A2
C:\Documents and Settings\Hall\Cookies\hall@mediaplex[2].txt detected: Trace.TrackingCookie.media!A2
C:\Documents and Settings\Hall\Cookies\hall@questionmarket[2].txt detected: Trace.TrackingCookie.questionmarket!A2
C:\Documents and Settings\Hall\Cookies\hall@realmedia[2].txt detected: Trace.TrackingCookie.realmedia!A2
C:\Documents and Settings\Hall\Cookies\hall@revenue[2].txt detected: Trace.TrackingCookie.revenue!A2
C:\Documents and Settings\Hall\Cookies\hall@server.iad.liveperson[1].txt detected: Trace.TrackingCookie.server.iad.livepers!A2
C:\Documents and Settings\Hall\Cookies\hall@serving-sys[1].txt detected: Trace.TrackingCookie.serving-sys!A2
C:\Documents and Settings\Hall\Cookies\hall@smartadserver[1].txt detected: Trace.TrackingCookie.smartadserver!A2
C:\Documents and Settings\Hall\Cookies\hall@specificclick[2].txt detected: Trace.TrackingCookie.specificclick!A2
C:\Documents and Settings\Hall\Cookies\hall@statcounter[1].txt detected: Trace.TrackingCookie.statcounter!A2
C:\Documents and Settings\Hall\Cookies\hall@statse.webtrendslive[2].txt detected: Trace.TrackingCookie.statse.webtrendslive!A2
C:\Documents and Settings\Hall\Cookies\hall@tradedoubler[1].txt detected: Trace.TrackingCookie.tradedoubler!A2
C:\Documents and Settings\Hall\Cookies\hall@tribalfusion[2].txt detected: Trace.TrackingCookie.tribalfusion!A2
C:\Documents and Settings\Hall\Cookies\hall@tripod[1].txt detected: Trace.TrackingCookie.tripod!A2
C:\Documents and Settings\Hall\Cookies\hall@webtrends1.britishgas.co[1].txt detected: Trace.TrackingCookie.webtrends!A2
C:\Documents and Settings\Hall\Cookies\hall@zedo[2].txt detected: Trace.TrackingCookie.zedo!A2
C:\APPS\HOMEPAGE\HOMEPGUI.EXE detected: Virus.Win32.Trojan!IK
C:\APPS\IWF\IWF-Presentation.exe detected: Trojan.Win32.VB!IK
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe detected: Trojan.Win32.Patched!IK
C:\Program Files\Gemplus\GemSafe Libraries\BIN\pk2GemID.dll detected: Backdoor.Win32.NetControl!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-003-3wide.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-014-8upNoCaption.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-017-assort-1big-4small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-018-assort-1big-4small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-018w-assort-1big-4small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-020-assort-1big-8small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-021-assort-1big-8small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-021w-assort-1big-8small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-039-8photoCollage.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-039w-8photoCollage.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-041-collage02.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-058-PhilHayes1upHalfText.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA4-059wc-PhilHayes1upHalfText.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA6-005-12up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumA6-005w-12up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumHagaki-005-12up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumHagaki-005w-12up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumHagaki-020-12upCollage.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumHagaki-020w-12upCollage.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumHagakiWideMargin-005-12up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumHagakiWideMargin-005w-12up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumHagakiWideMargin-020-12upCollage.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumHagakiWideMargin-020w-12upCollage.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLegal-103-index3across.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-014-8upNoCaption.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-014w-8upNoCaption.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-018-assort-1big-4small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-018w-assort-1big-4small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-021-assort-1big-8small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-021w-assort-1big-8small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-026-assort-1big-12small-ring.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-039w-8photoCollage.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-041-collage02.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-058-PhilHayes1upHalfText.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-059wc-PhilHayes1upHalfText.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-103-index3across.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumLetter-124w-index4across.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumPhoto2L-002wc-2up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumPhotoL-004c-2up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumPhotoL-004wc-2up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumPhotoLtab-004c-2up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumPhotoLtab-004wc-2up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumPostcardWideMargin-004w-8up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumPostcardWideMargin-006w-1big4small.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumSuperB-003-2up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumTabloid-004-3up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\albumTabloid-006-5up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA4-008-9wallets.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA6-001-borderless.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA6-002-6x8cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA6-003-7x10cm(E).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA6-004-9x13cm(L).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA6-006-10x15cm(maxPrintArea).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA6-042-64x84mm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA6-043-74x100mm(E).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA6-044-89x127mm(L).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsA6-046-100x148mm(maxPrintArea).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagaki-001-borderless.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagaki-002-6x8cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagaki-003-7x10cm(E).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagaki-004-9x13cm(L).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagaki-006-10x15cm(Hagaki).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagaki-008-3x4cm9up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagaki-010-Sticker16up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagakiWideMargin-002-6x8cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagakiWideMargin-008-3x4cm9up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsHagakiWideMargin-010-Sticker16up.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsIndexCard-005-16miniID.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsIndexCard-042-64x84mm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsIndexCard-048-25x38mm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsIndexCard-201-3x4cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsIndexCard-202-6x8cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcard-005-16miniID.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcard-042-64x84mm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcard-048-25x38mm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcard-201-3x4cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcard-202-6x8cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-001-3.5x5.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-002-fullsize.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-005-16miniID.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-042-64x84mm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-043-74x100mm(E).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-044-89x127mm(L).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-046-100x148mm(maxPrintArea).htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-048-25x38mm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-201-3x4cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-202-6x8cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-203-9x13cm.htm detected: Worm.Win32.Mefir!IK
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\Templates\printsPostcardWideMargin-204-10x15cm(maxPrintArea).htm detected: Worm.Win32.Mefir!IK