Batter Up: W32/Bagle.RC.worm - hldrrr.exe (think got rid of wintems.exe & mdelk.exe)

Rorschach112 · Jan 23, 2008

Hello

Download and run SafeBootKeyRepair-CF from:

http://download.bleepingcomputer.com/sUBs/SafeBootKeyRepair.exe
or
http://www.techsupportforum.com/sectools/sUBs/SafeBootKeyRepair-CF.exe

It will take only a moment for it to run.
A log will be produced at C:\SafeBoot_Repair.txt. Please post that in your next reply

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

Folder::
C:\WINDOWS\system32\drivers\down

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

EasyEEE · Jan 23, 2008

Hello, and thanks again for the help!

SafeBoot Repair

Reg export of SafeBoot key after repair:
========================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]
"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpcdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpwd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdsessmgr]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SharedAccess]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdpipe.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdtcp.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\termservice]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WZCSVC]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
@="Net"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
@="NetClient"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
@="NetService"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
@="NetTrans"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

========================

EasyEEE · Jan 23, 2008

ComboFix - Part 1 after running new/short script:

ComboFix 08-01-23.2 - Owner 2008-01-23 14:49:24.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1593 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Owner\Application Data\m\flec006.exe
C:\WINDOWS\system32\drivers\down
C:\WINDOWS\system32\drivers\down\124687.exe
C:\WINDOWS\system32\drivers\down\132234.exe
C:\WINDOWS\system32\drivers\down\134390.exe
C:\WINDOWS\system32\drivers\down\137687.exe
C:\WINDOWS\system32\drivers\down\139546.exe
C:\WINDOWS\system32\drivers\down\143531.exe
C:\WINDOWS\system32\drivers\down\14720625.exe
C:\WINDOWS\system32\drivers\down\14745734.exe
C:\WINDOWS\system32\drivers\down\14747859.exe
C:\WINDOWS\system32\drivers\down\14751312.exe
C:\WINDOWS\system32\drivers\down\14761671.exe
C:\WINDOWS\system32\drivers\down\14770984.exe
C:\WINDOWS\system32\drivers\down\14796437.exe
C:\WINDOWS\system32\drivers\down\14802640.exe
C:\WINDOWS\system32\drivers\down\14802750.exe
C:\WINDOWS\system32\drivers\down\148031.exe
C:\WINDOWS\system32\drivers\down\14808578.exe
C:\WINDOWS\system32\drivers\down\14812015.exe
C:\WINDOWS\system32\drivers\down\14844312.exe
C:\WINDOWS\system32\drivers\down\14845390.exe
C:\WINDOWS\system32\drivers\down\14853546.exe
C:\WINDOWS\system32\drivers\down\14865218.exe
C:\WINDOWS\system32\drivers\down\14871031.exe
C:\WINDOWS\system32\drivers\down\14872718.exe
C:\WINDOWS\system32\drivers\down\14873171.exe
C:\WINDOWS\system32\drivers\down\14873687.exe
C:\WINDOWS\system32\drivers\down\14877234.exe
C:\WINDOWS\system32\drivers\down\14878968.exe
C:\WINDOWS\system32\drivers\down\14911875.exe
C:\WINDOWS\system32\drivers\down\14915781.exe
C:\WINDOWS\system32\drivers\down\14923234.exe
C:\WINDOWS\system32\drivers\down\190312.exe
C:\WINDOWS\system32\drivers\down\193578.exe
C:\WINDOWS\system32\drivers\down\194031.exe
C:\WINDOWS\system32\drivers\down\198828.exe
C:\WINDOWS\system32\drivers\down\200984.exe
C:\WINDOWS\system32\drivers\down\232718.exe
C:\WINDOWS\system32\drivers\down\233484.exe
C:\WINDOWS\system32\drivers\down\236406.exe
C:\WINDOWS\system32\drivers\down\241703.exe
C:\WINDOWS\system32\drivers\down\243453.exe
C:\WINDOWS\system32\drivers\down\245484.exe
C:\WINDOWS\system32\drivers\down\246093.exe
C:\WINDOWS\system32\drivers\down\246843.exe
C:\WINDOWS\system32\drivers\down\270250.exe
C:\WINDOWS\system32\drivers\down\272859.exe
C:\WINDOWS\system32\drivers\down\29338000.exe
C:\WINDOWS\system32\drivers\down\29341859.exe
C:\WINDOWS\system32\drivers\down\29343687.exe
C:\WINDOWS\system32\drivers\down\29345671.exe
C:\WINDOWS\system32\drivers\down\29350109.exe
C:\WINDOWS\system32\drivers\down\29352515.exe
C:\WINDOWS\system32\drivers\down\29368203.exe
C:\WINDOWS\system32\drivers\down\29371015.exe
C:\WINDOWS\system32\drivers\down\29371234.exe
C:\WINDOWS\system32\drivers\down\29376687.exe
C:\WINDOWS\system32\drivers\down\29378734.exe
C:\WINDOWS\system32\drivers\down\29380359.exe
C:\WINDOWS\system32\drivers\down\29380921.exe
C:\WINDOWS\system32\drivers\down\29384109.exe
C:\WINDOWS\system32\drivers\down\29390015.exe
C:\WINDOWS\system32\drivers\down\29391968.exe
C:\WINDOWS\system32\drivers\down\29392437.exe
C:\WINDOWS\system32\drivers\down\29392734.exe
C:\WINDOWS\system32\drivers\down\29393843.exe
C:\WINDOWS\system32\drivers\down\29395640.exe
C:\WINDOWS\system32\drivers\down\29396937.exe
C:\WINDOWS\system32\drivers\down\29427640.exe
C:\WINDOWS\system32\drivers\down\29429765.exe
C:\WINDOWS\system32\drivers\down\29436031.exe
C:\WINDOWS\system32\drivers\down\302578.exe
C:\WINDOWS\system32\drivers\down\304953.exe
C:\WINDOWS\system32\drivers\down\310906.exe
C:\WINDOWS\system32\drivers\down\43844406.exe
C:\WINDOWS\system32\drivers\down\43848078.exe
C:\WINDOWS\system32\drivers\down\43850421.exe
C:\WINDOWS\system32\drivers\down\43892437.exe
C:\WINDOWS\system32\drivers\down\43895375.exe
C:\WINDOWS\system32\drivers\down\43898000.exe
C:\WINDOWS\system32\drivers\down\43941828.exe
C:\WINDOWS\system32\drivers\down\43944203.exe
C:\WINDOWS\system32\drivers\down\43944390.exe
C:\WINDOWS\system32\drivers\down\43952187.exe
C:\WINDOWS\system32\drivers\down\43954203.exe
C:\WINDOWS\system32\drivers\down\43956906.exe
C:\WINDOWS\system32\drivers\down\43957593.exe
C:\WINDOWS\system32\drivers\down\43962218.exe
C:\WINDOWS\system32\drivers\down\43967953.exe
C:\WINDOWS\system32\drivers\down\43970437.exe
C:\WINDOWS\system32\drivers\down\43971281.exe
C:\WINDOWS\system32\drivers\down\43974828.exe
C:\WINDOWS\system32\drivers\down\43978625.exe
C:\WINDOWS\system32\drivers\down\43987078.exe
C:\WINDOWS\system32\drivers\down\43988875.exe
C:\WINDOWS\system32\drivers\down\44018937.exe
C:\WINDOWS\system32\drivers\down\44022828.exe
C:\WINDOWS\system32\drivers\down\44029203.exe
C:\WINDOWS\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\mdelk.exe
C:\WINDOWS\system32\wintems.exe
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SROSA
-------\srosa

((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 )))))))))))))))))))))))))))))))
.

2008-01-23 14:24 . 2008-01-23 14:24 <DIR> d-------- C:\WINDOWS\system32\drivers\down
2008-01-23 13:21 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-21 20:54 . 2008-01-21 21:20 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-21 15:42 . 2008-01-21 15:42 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-21 14:55 . 2008-01-21 14:55 <DIR> d-------- C:\Deckard
2008-01-20 00:00 . 2008-01-22 10:40 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-19 18:24 . 2008-01-19 18:24 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-19 18:24 . 2008-01-19 18:24 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-19 15:02 . 2008-01-20 08:04 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-01-18 23:27 . 2008-01-21 15:01 <DIR> d-------- C:\Program Files\RegSupreme Pro
2008-01-18 19:24 . 2008-01-18 19:24 <DIR> d-------- C:\WINDOWS\Sun
2008-01-18 13:10 . 2008-01-18 13:10 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-18 13:10 . 2008-01-18 14:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-18 12:59 . 2008-01-18 12:59 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-18 12:41 . 2008-01-18 12:42 <DIR> d-------- C:\Program Files\Ontrack
2008-01-18 10:12 . 2008-01-18 10:17 <DIR> d-------- C:\Program Files\Symantec Client Security
2008-01-18 10:04 . 2008-01-18 10:05 <DIR> d-------- C:\Sym EndPoint
2008-01-17 09:04 . 2008-01-17 09:05 <DIR> d-------- C:\Program Files\QuickTime
2008-01-15 20:11 . 2007-12-17 13:53 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-01-15 16:02 . 2008-01-21 20:28 <DIR> d-------- C:\HJSplit
2008-01-13 20:43 . 2008-01-13 20:43 <DIR> d-------- C:\Program Files\MediaMonkey
2008-01-13 20:34 . 2008-01-13 22:58 <DIR> d-------- C:\Music
2008-01-13 20:22 . 1999-12-13 01:01 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE
2008-01-13 20:22 . 1999-11-18 01:00 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE
2008-01-13 14:41 . 2008-01-13 14:41 74,703 --a------ C:\WINDOWS\system32\mfc45.dll
2008-01-13 11:40 . 2008-01-13 11:40 <DIR> d-------- C:\Program Files\Apple Software Update
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-07 16:36 . 2008-01-07 16:36 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-01-06 23:27 . 2008-01-06 23:27 <DIR> d-------- C:\Program Files\YourWare Solutions
2008-01-04 11:15 . 2008-01-17 10:27 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-01-04 11:15 . 2008-01-07 16:36 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-01-04 11:15 . 2008-01-17 10:28 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-04 11:15 . 2008-01-04 11:15 319 --a------ C:\WINDOWS\game.ini
2008-01-04 10:22 . 2008-01-04 10:22 <DIR> d-------- C:\Program Files\Activision
2008-01-04 10:20 . 2008-01-04 10:20 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-01-03 19:19 . 2008-01-03 19:19 <DIR> d-------- C:\Program Files\Electronic Arts
2008-01-03 18:09 . 2008-01-21 20:27 <DIR> d-------- C:\Saved
2008-01-03 16:26 . 2008-01-03 16:26 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-01-03 16:25 . 2008-01-03 16:25 <DIR> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-01-02 23:28 . 2008-01-15 20:35 <DIR> d-------- C:\WINDOWS\nview
2008-01-02 23:28 . 2008-01-15 20:11 164,081 --a------ C:\WINDOWS\system32\nvapps.xml
2008-01-02 23:28 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-01-02 23:09 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-01-02 22:52 . 2008-01-02 22:52 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-01-02 22:52 . 2008-01-02 22:52 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-01-01 23:45 . 2008-01-01 23:45 <DIR> d-------- C:\Program Files\ASUS
2008-01-01 23:21 . 2008-01-07 23:36 <DIR> d-------- C:\Program Files\SpeedFan
2008-01-01 18:58 . 2008-01-01 23:21 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2008-01-01 13:38 . 2008-01-01 13:38 <DIR> d-------- C:\Mini CD DVD Images
2008-01-01 11:22 . 2008-01-01 11:23 <DIR> d-------- C:\Program Files\RivaTuner v2.06
2007-12-24 11:33 . 2007-12-24 11:33 <DIR> d-------- C:\Program Files\DVD Decrypter
2007-12-24 11:27 . 2007-12-24 11:27 <DIR> d-------- C:\Program Files\DVD Shrink
2007-12-23 05:19 . 2008-01-13 20:58 <DIR> d--h----- C:\Program Files\Creative Installation Information
2007-12-23 05:19 . 2007-12-23 05:19 <DIR> d-------- C:\Program Files\Common Files\Creative
2007-12-23 05:15 . 2008-01-13 20:58 <DIR> d-------- C:\Program Files\Creative

EasyEEE · Jan 23, 2008

ComboFix - Part 2 after running new/short script:

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-23 00:23 --------- d-----w C:\Program Files\eMule
2008-01-21 20:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-21 19:55 --------- d-----w C:\Program Files\Symantec
2008-01-20 00:50 --------- d-----w C:\Program Files\Google
2008-01-20 00:24 --------- d-----w C:\Program Files\Digital Media Reader
2008-01-13 02:18 --------- d-----w C:\Program Files\Microsoft Games
2008-01-08 23:35 --------- d-----w C:\Program Files\Common Files\Nero
2008-01-04 05:17 --------- d-----w C:\Program Files\NewsBin
2007-12-23 03:57 --------- d-----w C:\Program Files\Nero
2007-12-23 03:26 --------- d-----w C:\Program Files\DVD2one V2
2007-12-22 01:33 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-12-21 19:10 --------- d-----w C:\Program Files\Sierra Entertainment
2007-12-21 08:00 --------- d-----w C:\Program Files\MSXML 4.0
2007-12-21 01:12 --------- d-----w C:\Program Files\Common Files\Microsoft Games
2007-12-18 17:59 --------- d-----w C:\Program Files\IrfanView
2007-12-08 12:53 --------- d-----w C:\Program Files\DAEMON Tools
2007-12-08 12:49 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-12-07 19:31 --------- d-----w C:\Program Files\GameHouse
2007-12-05 07:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-05 06:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-12-05 06:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-12-05 06:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-12-05 06:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-12-05 06:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-12-05 06:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-12-05 06:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-12-05 06:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-12-05 06:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-12-05 06:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-12-05 06:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-12-05 06:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-12-05 06:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-12-05 06:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-12-05 06:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-12-05 06:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-12-05 06:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-12-05 06:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-12-05 06:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 06:41 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-12-05 06:41 2,498,560 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-12-05 06:41 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-12-05 06:41 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-12-05 06:41 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-12-05 06:41 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-12-05 06:41 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-12-05 06:41 1,474,560 ----a-w C:\WINDOWS\system32\nview.dll
2007-12-05 06:41 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-12-05 06:41 1,228,800 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-12-05 06:41 1,089,536 ----a-w C:\WINDOWS\system32\nvcuda.dll
2007-12-05 06:41 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
2007-12-05 01:21 --------- d-----w C:\Program Files\AC3Filter
2007-12-05 01:04 --------- d-----w C:\Program Files\DivX
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 01:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 01:33 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 01:33 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2007-12-03 21:39 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-03 16:40 --------- d-----w C:\Program Files\QuickPar
2007-12-03 13:44 --------- d-----w C:\Program Files\McAfee
2007-12-03 13:08 --------- d-----w C:\Program Files\SystemRequirementsLab
2007-12-03 12:37 --------- d-----w C:\Program Files\Napster
2007-12-03 12:11 --------- d-----w C:\Program Files\Pure Networks
2007-12-03 12:10 --------- d-----w C:\Program Files\Common Files\AOL
2007-12-03 07:06 --------- d-----w C:\Program Files\MSN Encarta Plus
2007-12-03 07:06 --------- d-----w C:\Program Files\Microsoft Works
2007-12-03 07:04 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-12-03 07:04 --------- d-----w C:\Program Files\Viewpoint
2007-12-03 07:04 --------- d-----w C:\Program Files\Real
2007-12-03 07:04 --------- d-----w C:\Program Files\Common Files\Real
2007-12-03 07:04 --------- d-----w C:\Program Files\Common Files\Nullsoft
2007-12-03 07:03 --------- d-----w C:\Program Files\Common Files\Roxio Shared
2007-12-03 07:03 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-03 07:02 --------- d-----w C:\Program Files\Realtek
2007-12-03 07:01 --------- d-----w C:\Program Files\Microsoft Digital Image 2006
2007-12-03 07:00 --------- d-----w C:\Program Files\Java
2007-12-03 06:59 --------- d-----w C:\Program Files\Common Files\Java
2007-12-03 06:55 --------- d-----w C:\Program Files\Microsoft.NET
2007-12-03 06:55 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-12-03 06:50 --------- d-----w C:\Program Files\CyberLink
2007-12-03 06:49 --------- d-----w C:\Program Files\Common Files\New Boundary
2007-12-03 06:46 --------- d-----w C:\Program Files\CONEXANT
2007-12-03 05:38 --------- d-----w C:\Program Files\Windows Plus
2007-12-03 05:38 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-29 22:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-29 22:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-28 21:55 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-28 21:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-11-28 21:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-11-28 21:53 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-11-28 21:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-11-28 21:52 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:35 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:39 228,864 ----a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((( snapshot@2008-01-23_13.32.23.26 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-23 18:22:30 237,568 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-23 19:49:22 237,568 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 18:22:30 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-23 19:49:22 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 18:22:30 237,568 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-23 19:49:22 237,568 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 18:22:30 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-23 19:49:22 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 18:22:30 3,874,816 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-23 19:49:22 3,883,008 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-23 18:22:30 57,344 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 19:49:22 57,344 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 19:25:02 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_7e8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2004-10-08 05:03 837281]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-12-06 07:06 167368]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-11-23 17:12 851968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 13:36 14854144 C:\WINDOWS\RTHDCPL.EXE]
"Recguard"="%WINDIR%\SMINST\RECGUARD.EXE" [ ]
"readericon"="C:\Program Files\Digital Media Reader\readericon45G.exe" [2005-08-27 08:09 139264]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"Power2GoExpress"="C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe" [2007-09-29 16:53 2680104]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 19:16 1121792]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 20:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 23:56 64512]
"CLMLServer"="C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe" [2007-09-27 23:10 122880]
"CLJ"="" []
"CHotkey"="zHotkey.exe" [2004-12-08 20:57 550912 C:\WINDOWS\zHotkey.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
"EnableLUA"= 0 (0x0)

.
Contents of the 'Scheduled Tasks' folder
"2008-01-17 14:03:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-23 14:50:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

Rorschach112 · Jan 23, 2008

Hello

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
- Extended (if available otherwise Standard)
- Scan Options:
- Scan Archives
  Scan Mail Bases
Click OK
Now under select a target to scan:
- Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

EasyEEE · Jan 23, 2008

Scan is almost complete, with "4 viruses found" and "417 objects infected."

Should I have rebooted anywhere during this process? I haven't other than when ComboFix auto-rebooted.

Will post log here shortly. 91% complete.

-Brad

EasyEEE · Jan 23, 2008

Probably shouldn't have been using FireFox..

KASPERSKY ONLINE SCANNER REPORT - PART 1

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
2008-01-23 16:56
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 23/01/2008
Kaspersky Anti-Virus database records: 528347
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan Statistics:
Total number of scanned objects: 136481
Number of viruses found: 5
Number of infected objects: 494
Number of suspicious objects: 0
Duration of the scan process: 01:40:32

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Application Data\m\data.oct Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\30 Happy Easter Riddles Screensaver 5.0.zip/30 Happy Easter Riddles Screensaver 5.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\30 Happy Easter Riddles Screensaver 5.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\3D Mystic Wind Chimes 1.2.zip/3D Mystic Wind Chimes 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\3D Mystic Wind Chimes 1.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\A Peek at Mrs Radvelli's Bloomers 1.zip/A Peek at Mrs Radvelli's Bloomers 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\A Peek at Mrs Radvelli's Bloomers 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\A Tale of Two Cities 1.0.zip/A Tale of Two Cities 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\A Tale of Two Cities 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Absolutely Fabulous Screensaver 1.0.zip/Absolutely Fabulous Screensaver 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Absolutely Fabulous Screensaver 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Adisoft 2004+.zip/Adisoft 2004+.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Adisoft 2004+.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Adriana Lima 27 Screensaver 1.0.zip/Adriana Lima 27 Screensaver 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Adriana Lima 27 Screensaver 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Advanced Access Builder 1.51 b3.zip/Advanced Access Builder 1.51 b3.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Advanced Access Builder 1.51 b3.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Advanced RAR Repair 1.2.zip/Advanced RAR Repair 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Advanced RAR Repair 1.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Advanced System Cleaner 1.8.zip/Advanced System Cleaner 1.8.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Advanced System Cleaner 1.8.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Advene 0.23.zip/Advene 0.23.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Advene 0.23.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\AFPextract 1.0.zip/AFPextract 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\AFPextract 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Age of Mythology - River Styx map.zip/Age of Mythology - River Styx map.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Age of Mythology - River Styx map.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\AGEphone 1.50.2 Cracked.zip/AGEphone 1.50.2 Cracked.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\AGEphone 1.50.2 Cracked.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Aglare Video to 3GP Converter 1.0.zip/Aglare Video to 3GP Converter 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Aglare Video to 3GP Converter 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Alert LinkRunner 6.0 build 11.zip/Alert LinkRunner 6.0 build 11.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Alert LinkRunner 6.0 build 11.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Allocator 1.zip/Allocator 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Allocator 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Animated Desktop 1.2.4.zip/Animated Desktop 1.2.4.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Animated Desktop 1.2.4.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Antivirus.Avast.Profesional.Edition.V.4.7.Spanish.Keygen.zip/Antivirus.Avast.Profesional.Edition.V.4.7.Spanish.Keygen.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Antivirus.Avast.Profesional.Edition.V.4.7.Spanish.Keygen.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ArchiCrypt Shredder 3.5.1.zip/ArchiCrypt Shredder 3.5.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ArchiCrypt Shredder 3.5.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Arlington Text to Speech 2.1.zip/Arlington Text to Speech 2.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Arlington Text to Speech 2.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ASPPack GroupWare 2.1.2 (Cracked).zip/ASPPack GroupWare 2.1.2 (Cracked).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ASPPack GroupWare 2.1.2 (Cracked).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\AutoSlideshow 0.2.1.zip/AutoSlideshow 0.2.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\AutoSlideshow 0.2.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\BeautyHobby Toolbar 1.0 [Crack].zip/BeautyHobby Toolbar 1.0 [Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\BeautyHobby Toolbar 1.0 [Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Birds Jigsaw Puzzle 1.0.zip/Birds Jigsaw Puzzle 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Birds Jigsaw Puzzle 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Birthday Organizer 5.0 Cracked.zip/Birthday Organizer 5.0 Cracked.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Birthday Organizer 5.0 Cracked.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Block MDE Unlockers 1.1.zip/Block MDE Unlockers 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Block MDE Unlockers 1.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Blue Ad Robo 1.0.zip/Blue Ad Robo 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Blue Ad Robo 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Book Avis 1.4.2.0.zip/Book Avis 1.4.2.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Book Avis 1.4.2.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Brand Worlds Tools 1.zip/Brand Worlds Tools 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Brand Worlds Tools 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Break-In Textures Vol.1 [With Crack].zip/Break-In Textures Vol.1 [With Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Break-In Textures Vol.1 [With Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\BroadWave 1.01.zip/BroadWave 1.01.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\BroadWave 1.01.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Caribbean Treasures 1.zip/Caribbean Treasures 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Caribbean Treasures 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Cheerful Dogs Screensaver 1.0.zip/Cheerful Dogs Screensaver 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Cheerful Dogs Screensaver 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Chinesepera-kun Chinese Popup Dictionary 0.2.2.zip/Chinesepera-kun Chinese Popup Dictionary 0.2.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Chinesepera-kun Chinese Popup Dictionary 0.2.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Clicktionary English-Spanish 3.2.2 [With Crack].zip/Clicktionary English-Spanish 3.2.2 [With Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Clicktionary English-Spanish 3.2.2 [With Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Clipboard Washer 1.23.zip/Clipboard Washer 1.23.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Clipboard Washer 1.23.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Collectibles Organizer 3.6s [With Crack].zip/Collectibles Organizer 3.6s [With Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Collectibles Organizer 3.6s [With Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Complete Beowulf Interactive 1.10 [Key+Serial].zip/Complete Beowulf Interactive 1.10 [Key+Serial].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Complete Beowulf Interactive 1.10 [Key+Serial].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ContactGenie Exporter Basic Ed 1.1.11.zip/ContactGenie Exporter Basic Ed 1.1.11.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ContactGenie Exporter Basic Ed 1.1.11.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Cyfin SA Proxy 7.5.3.zip/Cyfin SA Proxy 7.5.3.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Cyfin SA Proxy 7.5.3.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Database Icon Collection 1.0 [Patch].zip/Database Icon Collection 1.0 [Patch].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Database Icon Collection 1.0 [Patch].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DaToInfo 2.0 (With Crack).zip/DaToInfo 2.0 (With Crack).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DaToInfo 2.0 (With Crack).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DB to HTML Express 3.0.zip/DB to HTML Express 3.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DB to HTML Express 3.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DBEasy 2.02.069.zip/DBEasy 2.02.069.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DBEasy 2.02.069.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Descent OpenGL 1.27.zip/Descent OpenGL 1.27.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Descent OpenGL 1.27.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Drag-N-Dropper for MS Access 4.3.zip/Drag-N-Dropper for MS Access 4.3.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Drag-N-Dropper for MS Access 4.3.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DrWeb.4.32.NhT.zip/DrWeb.4.32.NhT.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DrWeb.4.32.NhT.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Duplicate File Finder 3.1.zip/Duplicate File Finder 3.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Duplicate File Finder 3.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DWG Miner DLL 2.3.42 Key+Serial.zip/DWG Miner DLL 2.3.42 Key+Serial.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\DWG Miner DLL 2.3.42 Key+Serial.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Earthling 1.0.zip/Earthling 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Earthling 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Easy Batch Watermark 3.0 (With Crack).zip/Easy Batch Watermark 3.0 (With Crack).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Easy Batch Watermark 3.0 (With Crack).zip ZIP: infected - 1 skipped

EasyEEE · Jan 23, 2008

Hrm..

KASPERSKY ONLINE SCANNER REPORT - PART 2

C:\Documents and Settings\Owner\Application Data\m\shared\Easy Photo Recovery 1.4.1 Key+Serial.zip/Easy Photo Recovery 1.4.1 Key+Serial.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Easy Photo Recovery 1.4.1 Key+Serial.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Electronic Bird HotMailPlus 2.0 (Cracked).zip/Electronic Bird HotMailPlus 2.0 (Cracked).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Electronic Bird HotMailPlus 2.0 (Cracked).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\EMCO Permissions Audit 1.0 (Key).zip/EMCO Permissions Audit 1.0 (Key).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\EMCO Permissions Audit 1.0 (Key).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Estard Data Miner 1.2.5.zip/Estard Data Miner 1.2.5.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Estard Data Miner 1.2.5.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Evaluation Tracker 2.2.2.zip/Evaluation Tracker 2.2.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Evaluation Tracker 2.2.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ExecutiveSync 1.2.2.zip/ExecutiveSync 1.2.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ExecutiveSync 1.2.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\eXPert PDF Editor Professional Edition 1.zip/eXPert PDF Editor Professional Edition 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\eXPert PDF Editor Professional Edition 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\EZ Macros 5.0a.zip/EZ Macros 5.0a.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\EZ Macros 5.0a.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\FileSort 1.5.146.zip/FileSort 1.5.146.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\FileSort 1.5.146.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\FirstStop WebSearch Visual Edition 4.21.zip/FirstStop WebSearch Visual Edition 4.21.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\FirstStop WebSearch Visual Edition 4.21.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Flaredance Firework Screensaver 1.1.zip/Flaredance Firework Screensaver 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Flaredance Firework Screensaver 1.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Flash Effect Maker Pro 3.5.zip/Flash Effect Maker Pro 3.5.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Flash Effect Maker Pro 3.5.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Gaia Wallpaper Desktop 1.2.zip/Gaia Wallpaper Desktop 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Gaia Wallpaper Desktop 1.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Gatekeeper 1.02.zip/Gatekeeper 1.02.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Gatekeeper 1.02.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Good Keywords 2.0.1.zip/Good Keywords 2.0.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Good Keywords 2.0.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Google4india Toolbar 1.zip/Google4india Toolbar 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Google4india Toolbar 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\GUITAR COMBOS Ac Box Combo 1.0.zip/GUITAR COMBOS Ac Box Combo 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\GUITAR COMBOS Ac Box Combo 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\House Rules 1.0.2480.zip/House Rules 1.0.2480.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\House Rules 1.0.2480.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\HTMLSpy 1.04 Patch.zip/HTMLSpy 1.04 Patch.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\HTMLSpy 1.04 Patch.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\HydraLinks 1.2.zip/HydraLinks 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\HydraLinks 1.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Icon Collector Tool 1.2.zip/Icon Collector Tool 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Icon Collector Tool 1.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\IDN Conversion Tool 0.99.zip/IDN Conversion Tool 0.99.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\IDN Conversion Tool 0.99.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ie quick saver 1.1.zip/ie quick saver 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ie quick saver 1.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\IglooFTP PRO 3.9.zip/IglooFTP PRO 3.9.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\IglooFTP PRO 3.9.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ImTOO iPod Movie Converter 3.1.39.0809b Key+Serial.zip/ImTOO iPod Movie Converter 3.1.39.0809b Key+Serial.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ImTOO iPod Movie Converter 3.1.39.0809b Key+Serial.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\iNewYork 2.0.zip/iNewYork 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\iNewYork 2.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\InTriever 2007 build 06.10.23.1234.zip/InTriever 2007 build 06.10.23.1234.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\InTriever 2007 build 06.10.23.1234.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\iTunes miniRate 1.0.1.zip/iTunes miniRate 1.0.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\iTunes miniRate 1.0.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Kaspersky.Antyvirus.6.0.+.Key.zip/Kaspersky.Antyvirus.6.0.+.Key.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Kaspersky.Antyvirus.6.0.+.Key.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Kentico Compare SQL 1.0 KeyGen.zip/Kentico Compare SQL 1.0 KeyGen.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Kentico Compare SQL 1.0 KeyGen.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Keyboard Wizard 1.0 [With Crack].zip/Keyboard Wizard 1.0 [With Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Keyboard Wizard 1.0 [With Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\KidsSave 1.zip/KidsSave 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\KidsSave 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\KillCopy 2.84.zip/KillCopy 2.84.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\KillCopy 2.84.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Kongsoft MP3 CD Burner 1.04 p1 Serial.zip/Kongsoft MP3 CD Burner 1.04 p1 Serial.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Kongsoft MP3 CD Burner 1.04 p1 Serial.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Label Magic 2.1 (Serial).zip/Label Magic 2.1 (Serial).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Label Magic 2.1 (Serial).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\LingvoSoft Learning Voice PhraseBook 2006 Albanian Thai 2.1.29.zip/LingvoSoft Learning Voice PhraseBook 2006 Albanian Thai 2.1.29.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\LingvoSoft Learning Voice PhraseBook 2006 Albanian Thai 2.1.29.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\LingvoSoft Picture Dictionary 2007 Polish - Arabic 1.1.19.zip/LingvoSoft Picture Dictionary 2007 Polish - Arabic 1.1.19.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\LingvoSoft Picture Dictionary 2007 Polish - Arabic 1.1.19.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Lisk CMS 4.3.zip/Lisk CMS 4.3.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Lisk CMS 4.3.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Live Help 123 2.2.zip/Live Help 123 2.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Live Help 123 2.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\LuraDocument PDF Compressor 4.2.02.15.zip/LuraDocument PDF Compressor 4.2.02.15.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\LuraDocument PDF Compressor 4.2.02.15.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MAGIX Music Maker 11 [Crack].zip/MAGIX Music Maker 11 [Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MAGIX Music Maker 11 [Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MailArmor 1.1.2 for Windows (Cracked).zip/MailArmor 1.1.2 for Windows (Cracked).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MailArmor 1.1.2 for Windows (Cracked).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MailCheck 2.0 Build 110202.zip/MailCheck 2.0 Build 110202.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MailCheck 2.0 Build 110202.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MailScan SMTP Server 5.2.zip/MailScan SMTP Server 5.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MailScan SMTP Server 5.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MarshallSoft DUN Dialer for PowerBASIC 2.1.zip/MarshallSoft DUN Dialer for PowerBASIC 2.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MarshallSoft DUN Dialer for PowerBASIC 2.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MCEBrowser 2.2.zip/MCEBrowser 2.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MCEBrowser 2.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MechWarrior 4 Vengeance 1.0.zip/MechWarrior 4 Vengeance 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MechWarrior 4 Vengeance 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Mobile AMR converter 1.5.0.zip/Mobile AMR converter 1.5.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Mobile AMR converter 1.5.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MoonlightTorrent 0.2.0.0.zip/MoonlightTorrent 0.2.0.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MoonlightTorrent 0.2.0.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MP3 Crawler 1.0 Serial.zip/MP3 Crawler 1.0 Serial.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MP3 Crawler 1.0 Serial.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\muCommander 0.8 beta 3.zip/muCommander 0.8 beta 3.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\muCommander 0.8 beta 3.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MusicPlayer X 3.0.zip/MusicPlayer X 3.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\MusicPlayer X 3.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\My Video Downloader 1.0.zip/My Video Downloader 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\My Video Downloader 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\myGrid Solution 1.0 KeyGen.zip/myGrid Solution 1.0 KeyGen.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\myGrid Solution 1.0 KeyGen.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Nvu 1.0.zip/Nvu 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Nvu 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ObjectDock 1.9 Build 543.zip/ObjectDock 1.9 Build 543.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ObjectDock 1.9 Build 543.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Office Fitness Timer 1.2.zip/Office Fitness Timer 1.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Office Fitness Timer 1.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\OnLetterhead - Branded Email Stationary 3.0.0.0 (Patch).zip/OnLetterhead - Branded Email Stationary 3.0.0.0 (Patch).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\OnLetterhead - Branded Email Stationary 3.0.0.0 (Patch).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Operation Flashpoint Cold War Crisis - Advanced sound mod.zip/Operation Flashpoint Cold War Crisis - Advanced sound mod.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Operation Flashpoint Cold War Crisis - Advanced sound mod.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PAL Spyware Remover 1.1 Key+Serial.zip/PAL Spyware Remover 1.1 Key+Serial.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PAL Spyware Remover 1.1 Key+Serial.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PatentHunter 3.5.05 Key.zip/PatentHunter 3.5.05 Key.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PatentHunter 3.5.05 Key.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PC Draft PE 5.0.6 Patch.zip/PC Draft PE 5.0.6 Patch.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PC Draft PE 5.0.6 Patch.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PDF-to-HTML 1.1.zip/PDF-to-HTML 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PDF-to-HTML 1.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Peachtree Key 6.1.zip/Peachtree Key 6.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Peachtree Key 6.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Personal Finance Quizzes 1.zip/Personal Finance Quizzes 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Personal Finance Quizzes 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Photos Manager 1.0 [With Crack].zip/Photos Manager 1.0 [With Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped

EasyEEE · Jan 23, 2008

And the hits just keep coming..

KASPERSKY ONLINE SCANNER REPORT - PART 3

C:\Documents and Settings\Owner\Application Data\m\shared\Photos Manager 1.0 [With Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Picture Resizing Utility 1.0.zip/Picture Resizing Utility 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Picture Resizing Utility 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Pixbook 2.9C.zip/Pixbook 2.9C.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Pixbook 2.9C.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Plato DVD + Video to iPod Package 6.71 [Key+Serial].zip/Plato DVD + Video to iPod Package 6.71 [Key+Serial].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Plato DVD + Video to iPod Package 6.71 [Key+Serial].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Power Layers 1.1.8.10 [Serial].zip/Power Layers 1.1.8.10 [Serial].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Power Layers 1.1.8.10 [Serial].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Power Systems Analysis 1.1.zip/Power Systems Analysis 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Power Systems Analysis 1.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Power Video to Audio Converter 1.03 [Crack].zip/Power Video to Audio Converter 1.03 [Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Power Video to Audio Converter 1.03 [Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Presentation Manager 2.01 (With Crack).zip/Presentation Manager 2.01 (With Crack).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Presentation Manager 2.01 (With Crack).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PrintDirect Anywhere 2.00.zip/PrintDirect Anywhere 2.00.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PrintDirect Anywhere 2.00.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PSYBMail 1.1.0.124.zip/PSYBMail 1.1.0.124.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\PSYBMail 1.1.0.124.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Punch Clock 2005 1.3 (Cracked).zip/Punch Clock 2005 1.3 (Cracked).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Punch Clock 2005 1.3 (Cracked).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\pVoice 2.2 Beta 5.zip/pVoice 2.2 Beta 5.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\pVoice 2.2 Beta 5.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\QDictionary 2006.10.25.zip/QDictionary 2006.10.25.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\QDictionary 2006.10.25.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\QNote 1.0 [Patch].zip/QNote 1.0 [Patch].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\QNote 1.0 [Patch].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Quark ALAP ImagePort 1.4.zip/Quark ALAP ImagePort 1.4.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Quark ALAP ImagePort 1.4.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\quick.heal.x-gen.v7.00.zip/quick.heal.x-gen.v7.00.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\quick.heal.x-gen.v7.00.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\React! 1.0.zip/React! 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\React! 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Real Estate Follow Up Software (REFUS) 1.zip/Real Estate Follow Up Software (REFUS) 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Real Estate Follow Up Software (REFUS) 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Real-Time Server 1.10.zip/Real-Time Server 1.10.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Real-Time Server 1.10.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Recolored 1.0.1.zip/Recolored 1.0.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Recolored 1.0.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Red Cells 1.0.2.zip/Red Cells 1.0.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Red Cells 1.0.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\RefreshForce 1.10.zip/RefreshForce 1.10.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\RefreshForce 1.10.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Registry Explorer 1.4.4.zip/Registry Explorer 1.4.4.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Registry Explorer 1.4.4.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Registry Master 2.0.1 (Cracked).zip/Registry Master 2.0.1 (Cracked).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Registry Master 2.0.1 (Cracked).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Restaurant Billing Software 4.5 Crack.zip/Restaurant Billing Software 4.5 Crack.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Restaurant Billing Software 4.5 Crack.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Revel 1.1.0.zip/Revel 1.1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Revel 1.1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Scheduler 1.0.zip/Scheduler 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Scheduler 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ShredIt 5.7.zip/ShredIt 5.7.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ShredIt 5.7.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\SiteMonNak 2004 V1.0.0 (Key+Serial).zip/SiteMonNak 2004 V1.0.0 (Key+Serial).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\SiteMonNak 2004 V1.0.0 (Key+Serial).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\sMonitor 4.1 build 1250.zip/sMonitor 4.1 build 1250.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\sMonitor 4.1 build 1250.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\SnippetEdit 1.0.zip/SnippetEdit 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\SnippetEdit 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Softstunt MP4 Video Converter 2.0.zip/Softstunt MP4 Video Converter 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Softstunt MP4 Video Converter 2.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Softstunt Video to iPod Zune PSP 3GP 2.0 Serial.zip/Softstunt Video to iPod Zune PSP 3GP 2.0 Serial.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Softstunt Video to iPod Zune PSP 3GP 2.0 Serial.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Soliton 3.1.zip/Soliton 3.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Soliton 3.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Sound Energy Volume Control 1.0.zip/Sound Energy Volume Control 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Sound Energy Volume Control 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Spam Sweeper 3.4.zip/Spam Sweeper 3.4.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Spam Sweeper 3.4.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Spank the Frank 1.zip/Spank the Frank 1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Spank the Frank 1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Speaking Calendar 6.6.8 [Patch].zip/Speaking Calendar 6.6.8 [Patch].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Speaking Calendar 6.6.8 [Patch].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Spy-Kill Deluxe Edition 3.65.zip/Spy-Kill Deluxe Edition 3.65.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Spy-Kill Deluxe Edition 3.65.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\SunRav TestOfficePro 4.7.zip/SunRav TestOfficePro 4.7.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\SunRav TestOfficePro 4.7.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\SuperBot 4.7.0.70.zip/SuperBot 4.7.0.70.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\SuperBot 4.7.0.70.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Survey Import & Export 2005 3.0 Crack.zip/Survey Import & Export 2005 3.0 Crack.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Survey Import & Export 2005 3.0 Crack.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Table Tennis Pro V2 2.32.zip/Table Tennis Pro V2 2.32.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Table Tennis Pro V2 2.32.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Task Force 4 2.5a.zip/Task Force 4 2.5a.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Task Force 4 2.5a.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\TBClamWin 0.99b.zip/TBClamWin 0.99b.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\TBClamWin 0.99b.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Teddy Bear Demo Screensaver 1.0.zip/Teddy Bear Demo Screensaver 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Teddy Bear Demo Screensaver 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Teker 1.1.zip/Teker 1.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Teker 1.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Temproact 11.8.zip/Temproact 11.8.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Temproact 11.8.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Text Splitter 1.02.zip/Text Splitter 1.02.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Text Splitter 1.02.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Timeless Time & Expense 2.6.11.zip/Timeless Time & Expense 2.6.11.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Timeless Time & Expense 2.6.11.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Timer 3.0.zip/Timer 3.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Timer 3.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\TradingSolutions 4.0.070618 (With Crack).zip/TradingSolutions 4.0.070618 (With Crack).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\TradingSolutions 4.0.070618 (With Crack).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\TurboLaunch 5.0.10 [Crack].zip/TurboLaunch 5.0.10 [Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\TurboLaunch 5.0.10 [Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Tweak Total Commander 6.0.3.zip/Tweak Total Commander 6.0.3.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Tweak Total Commander 6.0.3.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Unreal Tournament 2004 Remote Strike mod.zip/Unreal Tournament 2004 Remote Strike mod.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Unreal Tournament 2004 Remote Strike mod.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Vancouver Gas Prices 1.0.zip/Vancouver Gas Prices 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped

EasyEEE · Jan 23, 2008

KASPERSKY ONLINE SCANNER REPORT - PART 4(?)

C:\Documents and Settings\Owner\Application Data\m\shared\Vancouver Gas Prices 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\VBAcodePrint97 1.4.67 (Cracked).zip/VBAcodePrint97 1.4.67 (Cracked).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\VBAcodePrint97 1.4.67 (Cracked).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Vidmex 1.38 [With Crack].zip/Vidmex 1.38 [With Crack].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Vidmex 1.38 [With Crack].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\View-It 1.3.25.zip/View-It 1.3.25.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\View-It 1.3.25.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\VisioForge Video Edit ActiveX Version 3.0.zip/VisioForge Video Edit ActiveX Version 3.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\VisioForge Video Edit ActiveX Version 3.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Visual CD Ripper 2.20 Crack.zip/Visual CD Ripper 2.20 Crack.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Visual CD Ripper 2.20 Crack.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\VLViewPort 1.0.zip/VLViewPort 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\VLViewPort 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Watching Bart 1.0.zip/Watching Bart 1.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Watching Bart 1.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WatermarkIt 1.0.1.8.zip/WatermarkIt 1.0.1.8.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WatermarkIt 1.0.1.8.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Whizlabs MCSE Exam (70-215) Simulator 6.zip/Whizlabs MCSE Exam (70-215) Simulator 6.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Whizlabs MCSE Exam (70-215) Simulator 6.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Wildlife Animals Screen Saver 3.0 Key+Serial.zip/Wildlife Animals Screen Saver 3.0 Key+Serial.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Wildlife Animals Screen Saver 3.0 Key+Serial.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WinBackup 2.0 Professional 2.0 (2.1.2).zip/WinBackup 2.0 Professional 2.0 (2.1.2).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WinBackup 2.0 Professional 2.0 (2.1.2).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Windows Commander Widget 1.0.2.zip/Windows Commander Widget 1.0.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Windows Commander Widget 1.0.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Winfiltre English version 3.1.zip/Winfiltre English version 3.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Winfiltre English version 3.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WinPersonalizer 5.3.2.zip/WinPersonalizer 5.3.2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WinPersonalizer 5.3.2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WinSettings Pro 2.zip/WinSettings Pro 2.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WinSettings Pro 2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WMA To WAV Converter 1.00.zip/WMA To WAV Converter 1.00.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\WMA To WAV Converter 1.00.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\X-Cleaner 4.0.0 [Serial].zip/X-Cleaner 4.0.0 [Serial].exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\X-Cleaner 4.0.0 [Serial].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\XLplus 2.0.18.zip/XLplus 2.0.18.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\XLplus 2.0.18.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Xteq Explorer LaunchPad 2.1.zip/Xteq Explorer LaunchPad 2.1.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Xteq Explorer LaunchPad 2.1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\YaCy 0.50.zip/YaCy 0.50.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\YaCy 0.50.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Yahadi 4.5 (Patch).zip/Yahadi 4.5 (Patch).exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\Yahadi 4.5 (Patch).zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ZoomBlaster Photo-Web 4.5.zip/ZoomBlaster Photo-Web 4.5.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ZoomBlaster Photo-Web 4.5.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ZSplitter 2.0.zip/ZSplitter 2.0.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\ZSplitter 2.0.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\[app.eng]Nod32.v.2.70.16.Nt.2000.Xp.2003.vista.x64.patch.fix.2.1.freddy.zip/[app.eng]Nod32.v.2.70.16.Nt.2000.Xp.2003.vista.x64.patch.fix.2.1.freddy.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\[app.eng]Nod32.v.2.70.16.Nt.2000.Xp.2003.vista.x64.patch.fix.2.1.freddy.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\m\shared\[ITA.+.PTBR].Avast!.Antivirus.4.6.691.Professional.Edition.+.Keygen_by_zicadu.zip/[ITA.+.PTBR].Avast!.Antivirus.4.6.691.Professional.Edition.+.Keygen_by_zicadu.exe Infected: Trojan-Downloader.Win32.Bagle.hi skipped
C:\Documents and Settings\Owner\Application Data\m\shared\[ITA.+.PTBR].Avast!.Antivirus.4.6.691.Professional.Edition.+.Keygen_by_zicadu.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\cert8.db Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\history.dat Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\key3.db Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\parent.lock Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Adobe\Acrobat\8.0\Updater\updater.log Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Adobe\Updater5\aumLib.log Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\6cm3zby8.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Application Data\Power2Go\CLML\CLDB.db Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008012320080124\index.dat Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\Acr7820.tmp Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\lilo2 Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temp\lilo3 Object is locked skipped
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

EasyEEE · Jan 23, 2008

Probably shouldn't have been using FireFox..

KASPERSKY ONLINE SCANNER REPORT - PART 5

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\Documents and Settings\Owner\Application Data\m\flec006.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\124687.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\137687.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\139546.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\14720625.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\14747859.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\14751312.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\29338000.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\29343687.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\29345671.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\43844406.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\43850421.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\43892437.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\hldrrr.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\mdelk.exe.vir Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\catchme2008-01-23_132818.17.zip/wintems.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\QooBox\Quarantine\catchme2008-01-23_132818.17.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\Registry_backups\LEGACY_SROSA.reg.dat Infected: Trojan-Downloader.Win32.Bagle.hp skipped
C:\QooBox\Quarantine\Registry_backups\services_srosa.reg.dat Infected: Trojan-Downloader.Win32.Bagle.hp skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10\A0001424.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10\A0001431.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10\A0001442.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10\A0001443.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10\A0001450.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10\A0001490.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10\A0001493.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001728.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001729.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001730.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001744.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001757.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001766.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001767.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001768.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001773.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001776.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001782.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001785.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001840.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001886.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001888.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001889.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001912.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001913.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001916.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001917.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001938.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001941.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11\A0001942.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002820.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002823.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002824.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002826.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002828.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002829.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002866.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002868.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002869.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002893.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002895.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002896.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002917.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002918.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13\A0002919.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP14\change.log Object is locked skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000139.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000141.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000142.exe Infected: Trojan.Win32.Pakes.bwy skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000144.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000145.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000146.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000147.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000148.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000149.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000150.exe Infected: Trojan.Win32.Pakes.bwy skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000151.exe Infected: Trojan.Win32.Pakes.bwy skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000152.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000155.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000156.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000158.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000159.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000176.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4\A0000177.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP5\A0000299.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP5\A0000300.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP5\A0000317.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP5\A0000318.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6\A0000452.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6\A0000453.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6\A0000460.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6\A0000484.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6\A0000494.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6\A0000660.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6\A0000663.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6\A0000730.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6\A0000734.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP7\A0000940.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{11222285-D408-4DC9-A291-CBD1F33671F5}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_7e8.dat Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP14\change.log Object is locked skipped

Scan process completed.

Rorschach112 · Jan 23, 2008

I think firefox is the least of your worries

This is what you get for using cracks

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, in the menu, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.

Also you can pretty much delete this folder, all the zip and exe files are rootkits

C:\Documents and Settings\Owner\Application Data\m

EasyEEE · Jan 23, 2008

Yeah, I've gotten lazy with swapping CD's over the last 15 years.

Two quick questions, these two .bat files

A0002764.bat;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP12;Probably BATCH.Virus;Renamed.;
A0002944.bat;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Probably BATCH.Virus;;

I accidently renamed the first one.. should I delete those? Dr.Web did not. Below is the rest of the report. I still have Dr.Web open.

Also, is there ANY anti-virus program one can run to prevent a virus from uninstalling it? Otherwise, what's the point?

Again, thanks for your help. Will steer clear of those things.

Dr.Web

ComboFix.bat;C:\ComboFix;Probably BATCH.Virus;;
A0002764.bat;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP12;Probably BATCH.Virus;Renamed.;
A0002944.bat;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Probably BATCH.Virus;;
googletoolbarnotifier.exe;c:\program files\google\googletoolbarnotifier\1.2.1128.5462;Win32.HLLM.Beagle;Deleted.;
flec006.exe.vir;C:\QooBox\Quarantine\C\Documents and Settings\Owner\Application Data\m;Win32.HLLM.Beagle;Deleted.;
mdelk.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Win32.HLLM.Beagle;Deleted.;
hldrrr.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers;Win32.HLLM.Beagle;Deleted.;
124687.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
134390.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Trojan.PWS.Nerf;Deleted.;
137687.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
139546.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
14720625.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
14747859.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
14751312.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
29338000.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
29343687.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
29345671.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
43844406.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
43850421.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
43892437.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down;Win32.HLLM.Beagle;Deleted.;
A0001422.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001424.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001431.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001440.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Trojan.PWS.Nerf;Deleted.;
A0001442.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001443.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001447.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Trojan.PWS.Nerf;Deleted.;
A0001450.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001490.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001492.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Trojan.PWS.Nerf;Deleted.;
A0001493.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001523.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001651.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001691.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP10;Win32.HLLM.Beagle;Deleted.;
A0001728.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001729.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001730.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001744.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001756.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001757.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001766.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001767.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001768.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001770.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Trojan.PWS.Nerf;Deleted.;
A0001772.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Trojan.PWS.Nerf;Deleted.;
A0001773.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001776.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001782.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001784.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Trojan.PWS.Nerf;Deleted.;
A0001785.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001838.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Trojan.PWS.Nerf;Deleted.;
A0001840.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001860.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Trojan.PWS.Nerf;Deleted.;
A0001886.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001888.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001889.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001911.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Trojan.PWS.Nerf;Deleted.;
A0001912.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001913.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001915.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Trojan.PWS.Nerf;Deleted.;
A0001916.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001917.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001938.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001940.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Trojan.PWS.Nerf;Deleted.;
A0001941.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0001942.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP11;Win32.HLLM.Beagle;Deleted.;
A0002820.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002822.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Trojan.PWS.Nerf;Deleted.;
A0002823.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002824.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002826.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002828.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002829.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002866.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002868.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002869.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002893.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002895.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002896.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002917.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002918.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002919.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP13;Win32.HLLM.Beagle;Deleted.;
A0002989.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP14;Win32.HLLM.Beagle;Deleted.;
A0000022.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000139.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000140.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Trojan.PWS.Nerf;Deleted.;
A0000141.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000142.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000143.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Trojan.PWS.Nerf;Deleted.;
A0000144.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000145.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000146.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000147.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000148.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000149.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000150.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000151.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000152.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000153.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Trojan.PWS.Nerf;Deleted.;
A0000154.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Trojan.PWS.Nerf;Deleted.;
A0000155.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000156.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000157.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Trojan.PWS.Nerf;Deleted.;
A0000158.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000159.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000175.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000176.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000177.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP4;Win32.HLLM.Beagle;Deleted.;
A0000299.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP5;Win32.HLLM.Beagle;Deleted.;
A0000300.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP5;Win32.HLLM.Beagle;Deleted.;
A0000315.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP5;Win32.HLLM.Beagle;Deleted.;
A0000317.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP5;Win32.HLLM.Beagle;Deleted.;
A0000318.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP5;Win32.HLLM.Beagle;Deleted.;
A0000451.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000452.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000453.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000460.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000484.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000493.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Trojan.PWS.Nerf;Deleted.;
A0000494.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000510.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Trojan.PWS.Nerf;Deleted.;
A0000660.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000662.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Trojan.PWS.Nerf;Deleted.;
A0000663.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000667.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Trojan.PWS.Nerf;Deleted.;
A0000730.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000733.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Trojan.PWS.Nerf;Deleted.;
A0000734.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP6;Win32.HLLM.Beagle;Deleted.;
A0000940.exe;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP7;Win32.HLLM.Beagle;Deleted.;
A0001012.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP8;Win32.HLLM.Beagle;Deleted.;
A0001247.sys;C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP9;Win32.HLLM.Beagle;Deleted.;

Rorschach112 · Jan 24, 2008

Hello

I accidently renamed the first one.. should I delete those? Dr.Web did not. Below is the rest of the report. I still have Dr.Web open.

Don't worry about that

Also, is there ANY anti-virus program one can run to prevent a virus from uninstalling it? Otherwise, what's the point?

Anti-virus programs can only do so much, especially when people go out of their way to get infected.

Few things to do

You can delete the tools that we used

You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here

Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

EasyEEE · Jan 24, 2008

Sincerely appreciate your time, knowledge & patience.

Although I don't use it much, IE7 now opens up without hanging for 3-4 minutes.

I've done all the steps, and just installed SpywareBlaster, and am moving on to the others.

Thanks again!

-Brad

Rorschach112 · Jan 24, 2008

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

For new problems, please start a new topic and include a fresh HijackThis log and a link to this thread in your new topic.

Everyone else please begin a New Topic.

Batter Up: W32/Bagle.RC.worm - hldrrr.exe (think got rid of wintems.exe & mdelk.exe)

Rorschach112

Retired Security Volunteer

EasyEEE

New member

EasyEEE

New member

EasyEEE

New member

Rorschach112

Retired Security Volunteer

EasyEEE

New member

EasyEEE

New member

EasyEEE

New member

EasyEEE

New member

EasyEEE

New member

EasyEEE

New member

Rorschach112

Retired Security Volunteer

EasyEEE

New member

Rorschach112

Retired Security Volunteer

EasyEEE

New member

Rorschach112

Retired Security Volunteer