This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

need winfixer removal help, please!

167 min read

This thread's last reply is from December 16, 2005, 7:55 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

floete
November 18, 2005, 1:32 AM UTC
i'm having *major* problems with files suddenly going missing. what have i done?

meanwhile, here's the hijackthis log. more in a followup message.

Logfile of HijackThis v1.99.1
Scan saved at 8:30:48 PM, on 11/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ClipMate6\ClipMate.exe
C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\kv\Desktop\hijack results\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [ISLP2STA.EXE] ISLP2STA.EXE START
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ClipMate6] C:\Program Files\ClipMate6\ClipMate.exe
O4 - Startup: ePrompter.lnk = C:\Program Files\ePrompter\ePrompter.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.cox.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/ ... nicode.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://66.29.7.159/toolbar/cabs/free_access.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Unknown owner - C:\WINDOWS\System32\DVDRAMSV.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Mouse Hardware Sync (mousehs) - Unknown owner - C:\WINDOWS\System32\mousehs.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)
O23 - Service: Swupdtmr - Unknown owner - c:\toshiba\ivp\swupdate\swupdtmr.exe (file missing)
floete
November 18, 2005, 1:43 AM UTC
what should i freaking do? here's the deal:

the ewido report is over 200 pages long; the kaspersky report is 453 pages long!!!!!; and the panda report is 35 pages long.

:shock:

do you really want me to send them to you?

btw: almost all of the so-called infected files have the word 'bagle' in them.

good lord almighty. if things were bad before, they seem worse now. for one thing, txt files will no longer open with a double click; instead i get a message saying the file can't be found. but i can open them with, for instance, word perfect.
amateur
November 18, 2005, 1:44 AM UTC
You haven't done anything. You still have an infection. I am waiting for the other logs and reports. We'll sort it out. Dont' worry.
floete
November 18, 2005, 1:47 AM UTC
so do you want me to send you those other logs and reports, eventho they're so long? if so, do you want them as attachments or pasted into this message body?
amateur
November 18, 2005, 1:51 AM UTC
453 pages vow..... Try attaching them.
floete
November 18, 2005, 1:54 AM UTC
actually, i don't see any way to attach messages. what can i do? i assume you don't want me to paste 35 pages into a message much less 450. or do you?
amateur
November 18, 2005, 2:01 AM UTC
Perhaps you can try pasting the final pages of the reports where the summary is given.
floete
November 18, 2005, 2:12 AM UTC
i don't see a summary report anywhere for ewido.
here's the kaspersky summary

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Thursday, November 17, 2005 17:10:44
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 17/11/2005
Kaspersky Anti-Virus database records: 160399
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 102673
Number of viruses found: 4
Number of infected objects: 11779
Number of suspicious objects: 0
Duration of the scan process: 11029 sec


couldn't find a summary for panda either, so here in all its longwinded glory is the full panda report so you can see what we're dealing with. i see a good bit of pornographic stuff and other stuff as well.



Incident Status Location

Virus:W32/Bagle.N.worm Disinfected C:\Common.temp\Setup.exe
Virus:W32/Bagle.N.worm Disinfected C:\Controls.temp\Setup.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\Default User\Application Data\Symantec\Shared\XXX hardcore images.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Macromedia\Flash Player\#SharedObjects\XXX hardcore images.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Shareaza\XXX hardcore images.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Symantec\Shared\XXX hardcore images.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lacenfineness\shared\XXX hardcore images.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Application Data\Yahoo! Messenger\lilyofvalerie\shared\XXX hardcore images.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Local Settings\Application Data\Shareaza\XXX hardcore images.exe
Virus:W32/Bagle.N.worm Disinfected C:\Documents and Settings\kv\Local Settings\Temp\acs3676aa\acsuninstall.exe
Spyware:spyware/dyfuca No disinfected C:\Documents and Settings\kv\Local Settings\Temp\cfout.txt
Virus:W32/Bagle.N.worm Disinfected C:\Documents and Settings\kv\Local Settings\Temp\pft3.tmp\Disk1\Setup.exe
Virus:W32/Bagle.N.worm Disinfected C:\Documents and Settings\kv\Local Settings\Temp\vmpremov.exe
Virus:W32/Bagle.N.worm Disinfected C:\Documents and Settings\kv\Local Settings\Temp\ywreg.exe
Adware:Adware/Tracking No disinfected C:\Documents and Settings\kv\Local Settings\Temporary Internet Files\Content.IE5\WT2RG96B\advertising[1].htm
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\NetHood\SharedDocs on mine (Toshiba-user)\XXX hardcore images.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Documents and Settings\kv\Start Menu\Programs\Shareaza\XXX hardcore images.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\MSOCache\All Users\90000409-6000-11D3-8CFE-0150048383C9\FILES\PFILES\COMMON\MSSHARED\XXX hardcore images.exe
Virus:W32/Bagle.N.worm Disinfected C:\Program Files\a2 Free\a2scan.exe
Virus:W32/Bagle.N.worm Disinfected C:\Program Files\a2 Free\a2start.exe
Virus:W32/Bagle.N.worm Disinfected C:\Program Files\a2 Free\a2upd.exe
Virus:W32/Bagle.N.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Apps\PsaProxy.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\ACDSee 9.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Adobe Photoshop 9 full.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Ahead Nero 7.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Matrix 3 Revolution English Subtitles.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Microsoft Office 2003 Crack, Working!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Microsoft Office XP working Crack, Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Microsoft Windows XP, WinXP Crack, working Keygen.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Opera 8 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Porno pics arhive, xxx.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Porno Screensaver.scr
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Porno, sex, oral, anal cool, awesome!!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Serials.txt.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\WinAmp 5 Pro Keygen Crack Update.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\WinAmp 6 New!.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Windown Longhorn Beta Leak.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started\quick_guide\share\Windows Sourcecode update.doc.exe
Virus:W32/Bagle.T.worm Disinfected C:\Program Files\Adobe\Photoshop Album Starter Edition\2.0\Shared_Assets\locales\en_us\getting_started
amateur
November 18, 2005, 2:16 AM UTC
Were you able to run Spybot and Adaware?
floete
November 18, 2005, 2:20 AM UTC
spybot no, but adaware yes.
amateur
November 18, 2005, 2:27 AM UTC
Thank you for the logs. What's the report from Adaware?
floete
November 18, 2005, 2:31 AM UTC
i don't believe you asked for an adaware report, but here's what i could dig up w/out rerunning the program; it's a quarantine report. if i need to rerun it let me know.

======================================================

TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=IECache Entry : Cookie:[removed]/
obj[1]=IECache Entry : Cookie:[removed]/
obj[2]=IECache Entry : Cookie:[removed]/
obj[3]=IECache Entry : Cookie:[removed]/
obj[4]=IECache Entry : Cookie:[removed]/
obj[5]=IECache Entry : Cookie:[removed]/
obj[6]=IECache Entry : Cookie:[removed]/
obj[7]=IECache Entry : Cookie:[removed]/
obj[8]=IECache Entry : Cookie:[removed]/
obj[9]=IECache Entry : Cookie:[removed]/
obj[10]=IECache Entry : Cookie:[removed]/
obj[11]=IECache Entry : Cookie:[removed]/
obj[12]=IECache Entry : Cookie:[removed]/
obj[13]=IECache Entry : Cookie:[removed]/
obj[14]=IECache Entry : Cookie:[removed]/
obj[15]=IECache Entry : Cookie:[removed]/
obj[16]=IECache Entry : Cookie:[removed]/cgi-bin
obj[17]=IECache Entry : Cookie:[removed]/
obj[18]=IECache Entry : Cookie:[removed]/cgi-bin
obj[19]=IECache Entry : Cookie:[removed]/
obj[20]=IECache Entry : Cookie:[removed]/
obj[21]=IECache Entry : Cookie:[removed]/
obj[22]=IECache Entry : Cookie:[removed]/
obj[23]=IECache Entry : Cookie:[removed]/
obj[24]=IECache Entry : Cookie:[removed]/
obj[25]=IECache Entry : Cookie:[removed]/
obj[26]=IECache Entry : Cookie:[removed]/
amateur
November 18, 2005, 2:38 AM UTC
Thank you. I'll have to work on these and get back to you later.
floete
November 18, 2005, 2:39 AM UTC
thanks!

and it's off to bed i go.

btw / i'm in RI as well...
Nick-YF19
November 18, 2005, 12:20 PM UTC
Let me chime in. Looks like you got hit with the bagle worm which is a nasty. To make sure it is taken care of, download the stand alone McAfee avert Stinger here. There are also instructions on the page in the link. Run it. When done, click file, then save report to file and post it in your next reply.

Then download the Microsoft malicious Software tool from here and install and run it. You can't save the report in this one, but take a look at it and tell me if it found anything.

Let either fix anything they find and report what they did.

Also post a fresh hijackthis log after you are done.