PDA

View Full Version : win32.agent.wsg



Anita-1
2009-11-20, 13:35
// info: Rootkit removal help file
// copyright: (c) 2008-2009 Safer-Networking Ltd. All rights reserved.

:: RootAlyzer Results
File:"Unknown ADS","C:\Windows\winsxs\x86_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.0.6002.18005_none_b5c807ab2d93d829\System Diagnostics.xml: 0v1ieca3Feahez0jAwxjjk5uRh:$DATA"
File:"Unknown ADS","C:\Windows\winsxs\x86_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.0.6001.18000_none_b3dc8e9f30720cdd\System Diagnostics.xml: 0v1ieca3Feahez0jAwxjjk5uRh:$DATA"
File:"Unknown ADS","C:\Windows\PLA\System\System Diagnostics.xml: 0v1ieca3Feahez0jAwxjjk5uRh:$DATA"
File:"Unknown ADS","C:\Windows\Cursors\arrow_n.cur:NEDTA.DAT:$DATA"
File:"No admin in ACL","C:\Users\Anita\AppData\Local\Temp\~DF2B3F.tmp"
File:"No admin in ACL","C:\Users\Anita\AppData\Local\Temp\~DF3725.tmp"
File:"No admin in ACL","C:\Users\Anita\AppData\Local\Temp\~DF3EC5.tmp"
File:"No admin in ACL","C:\Users\Anita\AppData\Local\Temp\~DF454A.tmp"
File:"No admin in ACL","C:\Users\Anita\AppData\Local\Temp\~DF7982.tmp"
File:"No admin in ACL","C:\Users\Anita\AppData\Local\Temp\~DF798C.tmp"
File:"No admin in ACL","C:\Users\Anita\AppData\Local\Temp\~DF79D5.tmp"
File:"No admin in ACL","C:\Users\Anita\AppData\Local\Temp\~DF79DA.tmp"
File:"No admin in ACL","C:\Users\Anita\AppData\Local\Temp\~DF97F7.tmp"
File:"No admin in ACL","C:\Users\All Users\Microsoft\OFFICE\DATA\81599.bpc"
File:"No admin in ACL","C:\Users\All Users\Microsoft\OFFICE\DATA\OPA12.BAK"
File:"No admin in ACL","C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat"
File:"Unknown ADS","C:\perflogs\System\Diagnostics\20091116-0002\report.xml: Qgrg2rf1Znaluncm1kfl1xla5h:$DATA"
File:"Unknown ADS","C:\perflogs\System\Diagnostics\20091115-0001\report.xml: Qgrg2rf1Znaluncm1kfl1xla5h:$DATA"
Directory:"No admin in ACL","C:\Users\All Users\Microsoft\OFFICE\DATA"
Directory:"No admin in ACL","C:\ProgramData\Microsoft\OFFICE\DATA"

peku006
2009-11-25, 06:17
Hi Anita-1

Please see the forum FAQ which details how to produce a HJT log and copy paste it into a new topic.
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

peku006