really need help getting rid of virus's and worms

Question

Belinda_k 0 Newbie Poster

15 Years Ago

I have been having a lot of trouble with my pc for a bit now, most applications I click on say they are not valid win32 applications and when I try to down load a new antivirus the same thing happens. I can't run hijack this or malwarebytes(?) I downloaded all the things that were listed in the other thread about things to do before posting, none of them will run either, I just get the same not valid message. I can't boot in safe mode, it stops booting after the mup driver loads and automatically reboots, I have disabled the auto restart and I just get a bsod that has an error message and these numbers: *** STOP: 0X0000007B (0XF789E524, 0XC0000034, 0X00000000, 0X00000000)

I managed to run the online panda scan and I have the log here.

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-12-19 22:45:24
PROTECTIONS: 0
MALWARE: 44
SUSPECTS: 159
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@casalemedia[2].txt[/email]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@doubleclick[2].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@doubleclick[2].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@doubleclick[2].txt[/email]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.atdmt.com/]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@atdmt[2].txt[/email]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@atdmt[2].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@247realmedia[1].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@fastclick[1].txt[/email]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@fastclick[2].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@tribalfusion[1].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@tribalfusion[1].txt[/email]
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@mediaplex[1].txt
00147814 Cookie/AspinallsOnlineCasino TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@pacificpoker[1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.com.com/]
00167724 Cookie/HotLog TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@hotlog[1].txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@toplist[1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@statcounter[2].txt[/email]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@statcounter[2].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@statcounter[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@ad.yieldmanager[2].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@ad.yieldmanager[1].txt[/email]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@ad.yieldmanager[2].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@apmebf[1].txt[/email]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@apmebf[1].txt
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@burstnet[2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\RECYCLER\S-1-5-21-1220945662-725345543-682003330-500\Dc73\Cookies\temp@serving-sys[1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@serving-sys[2].txt[/email]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@serving-sys[1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@serving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.bs.serving-sys.com/]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\RECYCLER\S-1-5-21-1220945662-725345543-682003330-500\Dc73\Cookies\temp@bs.serving-sys[2].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@bs.serving-sys[2].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@bs.serving-sys[2].txt[/email]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@bs.serving-sys[1].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.adtech.de/]
00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@adtech[2].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@advertising[1].txt[/email]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@advertising[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@advertising[2].txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@statse.webtrendslive[1].txt[/email]
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@statse.webtrendslive[1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\RECYCLER\S-1-5-21-1220945662-725345543-682003330-500\Dc73\Cookies\temp@overture[1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@overture[1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.overture.com/]
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.overture.com/]
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.overture.com/]
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Belinda Kohry\Cookies\belinda [email]kohry@overture[1].txt[/email]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@realmedia[1].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@realmedia[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.questionmarket.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@zedo[2].txt
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@adrevolver[2].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.atwola.com/]
00431194 Adware/AdsRevenue Adware No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\0RRT327V\mm[1].js
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\CF2U6TDX(2)\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\CF2U6TDX(2)\b64_2[4].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\4SJ67RGE\b64_2[2].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\4SJ67RGE\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\Belinda Kohry\Local Settings\Temporary Internet Files\Content.IE5\YHISTC4N\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\CF2U6TDX(2)\b64_2[2].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\M5AK59H6(2)\b64_2[2].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\4O7BLVJ6\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\CF2U6TDX(2)\b64_2[3].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\0RRT327V\b64_2[2].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\0RRT327V\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\Belinda Kohry\Local Settings\Temporary Internet Files\Content.IE5\RABLVWFY\b64_2[2].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\Belinda Kohry\Application Data\drivers\downld\34667921.exe
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\4O7BLVJ6\b64_2[3].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\Belinda Kohry\Local Settings\Temporary Internet Files\Content.IE5\RABLVWFY\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\ZYFUD65T(2)\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\Belinda Kohry\Local Settings\Temporary Internet Files\Content.IE5\FG8RATLV\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\Belinda Kohry\Local Settings\Temporary Internet Files\Content.IE5\FG8RATLV\b64_2[2].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\Belinda Kohry\Local Settings\Temporary Internet Files\Content.IE5\H9S2LV56\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\4O7BLVJ6\b64_2[2].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\M5AK59H6(2)\b64_2[1].jpg
00452915 W32/Bagle.TO.worm Virus/Worm No 1 Yes No C:\Documents and Settings\Belinda Kohry\Application Data\drivers\downld\34675015.exe
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{3F7BBA3D-8BA0-4CDC-BE36-2A38D2A7F6C2}\RP9\A0003400.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP21\A0025872.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP22\A0025924.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP23\A0025928.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{3F7BBA3D-8BA0-4CDC-BE36-2A38D2A7F6C2}\RP9\A0003372.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP10\A0001963.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP23\A0026122.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP1\A0000003.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{3F7BBA3D-8BA0-4CDC-BE36-2A38D2A7F6C2}\RP9\A0003352.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP3\A0000289.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0020407.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{3F7BBA3D-8BA0-4CDC-BE36-2A38D2A7F6C2}\RP8\A0003305.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0021923.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP4\A0000323.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP4\A0000335.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0016694.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP4\A0000344.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP5\A0000644.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\drivers\srosa2.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP11\A0004958.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP11\A0005664.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP6\A0000943.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP12\A0007270.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP6\A0001940.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP14\A0010658.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP7\A0001962.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP14\A0012289.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\drivers\srosa2.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\RECYCLER\S-1-5-21-1220945662-725345543-682003330-500\Dc73\Application Data\drivers\srosa2.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP21\A0025268.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\Documents and Settings\Belinda Kohry\Application Data\drivers\srosa2.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0018134.sys
00459277 W32/Bagle.RC.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0019538.sys
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0019884.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0019015.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0018984.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0019853.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0018840.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0022336.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\drivers\downld\493000.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\drivers\downld\83964250.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\drivers\downld\550218.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\drivers\downld\550218.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\drivers\downld\83964250.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0022458.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0017611.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0017580.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP10\A0002376.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP10\A0002498.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0017436.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP11\A0004423.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP11\A0004545.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP11\A0006077.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP11\A0006199.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0016171.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0016140.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0019709.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP12\A0007683.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP12\A0007805.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0015996.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP14\A0012987.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP14\A0012843.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP14\A0011071.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP14\A0011193.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP14\A0012812.exe
00462995 Trj/Passtealer.HV Virus/Trojan No 0 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Local Settings\Temporary Internet Files\Content.IE5\4SJ67RGE\b64_1[2].jpg
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m\shared\Gui4Cli 19.0.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Yadabyte Passwords 1.0.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\xraster 0.9.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\XMLBuddy 2.09.zip[install_patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\XataSoft SideBar! 1.0.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\X-SOFT Media Player 2.0.1.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Windows XP Service Pack 2 Support Tools.zip[run.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\WebcamMax Standard 2.3.0.78.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Web Font Viewer 1.0.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Watermark me UP! 1.0.zip[keygen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Voxengo Stereo Touch 1.4.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Visual Studio Team System 2008 Team Foundation Server Power Tools 2.3 October 2008.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Visual Drawing Maker 1.14.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\View Folder Size Pro 5.00.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\VedosChat 4.01.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\VDesktop 0.0.0.1.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\TypingMaster QuickPhrase 4.0.0.91.zip[run.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\TweakUI 64-Bit Edition 2.2.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Tiger Screen Savers 5 1.0.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Symantec.Winfax.Pro.10.04.For.Win.Xp.updated-fixed.05-2006.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Symantec.Antivirus.Corporate.Edition.v10.0.1.1000.Win32.Final.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Symantec Mail Security License 1165464.7 Slf(5).zip[serial.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Stock Calculator 2.5.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Speak N Spell 1.2.0.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\SP IconXtractor 1.0.zip[keygen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Simple Port Forwarding 2.1.4.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\SharpEye 2.68.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\SE-Explorer 0.0.24.475.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\SAM 1.52.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\RSVP Reader 0.0.9.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Roxio Easy Media Creator 9.0.136 Build 901B36F.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Resource Explorer 1.2.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\ReplyButler 2.03.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\qTag 4.1.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\PS-Auto Periodic Restart 1.8.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\PrivateMessengerVB 1.0.0.zip[install_patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Private Encryptor 6.3.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Pidgin 2.5.2.zip[install_patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Patch for ANI Cursor Vulnerability.zip[serial.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Optinlistexploder 2.0.zip[serial.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Online Script Converter 1.0.zip[keygen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\ONI Payment Processor 1.17.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Office Tools 1.0.0.0.zip[install_patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Nokia free unlock codes calculator 3.10.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\NOD32.Remote.Administrator.Console.NT2000.XP.2003.1.0.11.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\No Spam Today! for Servers 3.1.5.1.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\NDSMagic 1.6.zip[serial.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\MySwissAlps Active Desktop 1024x768 1.0.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\MSD Documents 2.20.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\MS SQL Server Extract Data & Text Software 7.0.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\MovieDatabase 1.0.zip[serial.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Media Player DVD Maker 1.1.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\MeD's Movie Manager 2.6.1.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Maxim (PG) AIM Expression 1.0.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Loan Engine Lite 1.0.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\LiteCAD 0.1.0.7.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\LingvoSoft Suite 2008 English - Polish 2.1.28.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\knUniqueList 1.0.24.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Kaspersky.Antivirus.Personal.v6.0.1.411.Final.con.keyfiles.incluidos.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\JustExtractor 1.3.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\JPSViewer 1.1.2.zip[keygen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\ispy)(1).zip[serial.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\iPodRobot Video Converter 3.0.0.2537.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Internet Connector 1.0.0.3.zip[keygen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\International Morse Code 1.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Interactive DNS Query 1.2.zip[install_patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\InstantStretch 3.0.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\IMMonitor MSN Spy 2.2.8.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\I4X Screencatcher 1.0.0.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\HotPop 1.0.11a.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Hebrew Calendar Firefox Add-on 1.0.4.76.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Gui4Cli 19.0.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\GralicWrap for Windows 1.06.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Get all mails 1.0.4.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\FRSPCReboot 1.1.0.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Free Memory Widget 1.7.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\foo benchmark 1.0.1.zip[serial.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\FONmaker 1.01.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\fnc2003 1.0.11.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\FmPro Script Diff 1.0.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\FireTalk 1.6.0.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Extensions 2.0.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Excel To MySQL Converter 1.00.zip[install_patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Employers Search Plugin 2.4.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Easy Favorite 1.0.zip[keygen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\DVD-Toolbox 1.07.zip[install_patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Drop-n-Lock 1.0.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Drives Background Image 3.0.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\DllViewer 2.2 Build 153.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Deskzilla 1.6.1 Final.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Decreased Productivity 0.2.1.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Dealer Store Locator Map (USA) 1.01.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\CyD Windows Shell 2008.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Curves 1.0.zip[run.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Cropper 1.9.1.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Cralglist AutoPost 1.5.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\CorrectEnglish 1.0.1.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Conqueror Chat 3.1.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\CombineZM 1.0.zip[key_gen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\Colorado Home Real Estate Realtors 10.01.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\CoffeeCup HTML Editor 2008 Build 242.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\m(2)\shared\CLSearch 4.6.zip[patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\1-abc.net Settings Organizer 2.00.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\101 Screen Shots 1.02.zip[keygen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\365 Magnificent Flowers Screen Saver 2.1.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\3GP Video Converter 1.1.zip[crac.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\52 Sphereoids 1.00.zip[serial.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\ABC Amber Opera Converter 1.03.zip[install_crack.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\ABC Color With Me 1.0.zip[keygen.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\ABCFastDirectory 1.5.zip[install_patch.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\Aigo DVD to Zune Converter 2.0.13.zip[serial.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\All To All Converter 1.0.zip[key_generator.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\Amazon.com sidebargadget 2.0.0.zip[install.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\Amblit Easy Navigator 2.0.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\Andrew's Vector Plugins Volume 14 'StarCauldron' 14.1.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\Autodesk 3ds Max 2009 11.0.zip[setup.exe]
00487795 W32/Bagle.TS.worm Virus/Worm No 1 Yes No C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\shared\Automatic Motion Detecting Video Editor 1.0.zip[patch.exe]
00487795 W32/Ba

windows-virus

3 Contributors
9 Replies
498 Views
1 Week Discussion Span
Latest Post 15 Years Ago Latest Post by Belinda_k

cohen 17 Practically a Posting Shark

15 Years Ago

Pls do the following:

1. - Download Malwarebytes' Anti-Malware (http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

2. - Download hijackthis and post the log.

In your reply, post the logs (in this order):
1. - Malware Bytes Log
2. - Hijackthis Log

Thanks,

Cohen

maanu 0 Light Poster

15 Years Ago

try to run exe files in safe mood ,. or rename the exe file with .pif file then try to execute it .. hopefully it ll do the job ,

right back here what happen..

Maanu

cohen 17 Practically a Posting Shark

15 Years Ago

Belinda_k - Can you pls download HJT, the link is in my previous reply. Run it, scan, and then post the log.

Thanks,

Cohen

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Belinda_k 0 Newbie Poster · Answer 1 · 2008-12-21T18:26:37+00:00

This is malwarebytes log, it actually ran this time.
________________________________________________
Malwarebytes' Anti-Malware 1.31
Database version: 1528
Windows 5.1.2600 Service Pack 2

21/12/2008 11:16:40 PM
mbam-log-2008-12-21 (23-16-40).txt

Scan type: Full Scan (C:\|)
Objects scanned: 167293
Time elapsed: 47 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 42

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mule_st_key (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Belinda Kohry\Application Data\m (Trojan.Agent) -> Delete on reboot.

Files Infected:
C:\Documents and Settings\Belinda Kohry\Application Data\drivers\srosa2.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\drivers\srosa2.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1220945662-725345543-682003330-500\Dc73\Application Data\drivers\srosa2.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-299502267-602162358-725345543-1004\Dc1\Application Data\drivers\srosa2.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F7BBA3D-8BA0-4CDC-BE36-2A38D2A7F6C2}\RP8\A0003305.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F7BBA3D-8BA0-4CDC-BE36-2A38D2A7F6C2}\RP9\A0003372.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F7BBA3D-8BA0-4CDC-BE36-2A38D2A7F6C2}\RP9\A0003352.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3F7BBA3D-8BA0-4CDC-BE36-2A38D2A7F6C2}\RP9\A0003400.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP10\A0001963.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP11\A0004958.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP11\A0005664.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP12\A0007270.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP14\A0010658.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP14\A0012289.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0016694.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP20\A0018134.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP21\A0025268.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP21\A0025872.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP22\A0025924.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP23\A0025928.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{81EA92A7-9448-4FD1-9C0C-90D9CB9AAFB2}\RP23\A0026122.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP1\A0000003.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP3\A0000289.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP4\A0000323.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP4\A0000335.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BA3D906A-4AE8-4F1F-941B-76577E650302}\RP4\A0000344.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP5\A0000644.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP6\A0000943.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP6\A0001940.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP7\A0001962.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP8\A0002158.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F9D9D4EC-0AB0-4256-BF89-2930E6E9824D}\RP8\A0002172.sys (Worm.Bagel) -> Quarantined and deleted successfully.
C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\data.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\list.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\srvlist.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Belinda Kohry\Application Data\m\data.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Belinda Kohry\Application Data\m\list.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Belinda Kohry\Application Data\m\srvlist.oct (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mdelk.exe (Trojan.Spammer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wintems.exe (Trojan.Spammer) -> Delete on reboot.
C:\Documents and Settings\Belinda Kohry\Application Data\m\flec006.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\m\flec006.exe (Trojan.Agent) -> Quarantined and deleted successfully.
_________________________________________________

I can't get hijack this to work, it says it's not a valid win32 application.

Belinda

Belinda_k 0 Newbie Poster · Answer 2 · 2008-12-22T08:04:41+00:00

I've downloaded hijackthis but it won't run, it says it's not a valid win32 application.

I tried renaming exe to pif but still got same message as above. I also can't boot into safe mode, it stops at the mup.sys file and reboots itself, I disabled auto restart and tried safe mode but then after mup.sys I get a bsod. I've googled the problem but nothing I've tried seems to work.

Belinda

cohen 17 Practically a Posting Shark Featured Poster · Answer 3 · 2008-12-22T08:12:34+00:00

Alright, let's use combo fix.

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Thanks,

Cohen

Belinda_k 0 Newbie Poster · Answer 4 · 2008-12-22T18:51:14+00:00

Belinda_k 0 Newbie Poster

15 Years Ago

Ok, I managed to get safe mode runing for again (although it's now stopped again) and I ran combofix, I have attached the log with this. I still can't run hijackthis, when I did it ran for a couple of seconds and gave a log file only a couple of lines long.

I have also included an attachment for the panda log that doesn't seem to have posted correctly earlier.

Belinda

ComboFix.txt (129.87 KB)

The attachment preview is chopped off after the first 10 KB. Please download the entire file.

ComboFix 08-12-21.04 - Belinda_k 2008-12-22 22:30:27.1 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.959.821 [GMT 11:00]
Running from: c:\documents and settings\Belinda_k\Desktop\ComboFix.exe

[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Belinda Kohry\Application Data\drivers\downld
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\102437.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\102515.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\103375.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\103390.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\103437.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\103453.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\105921.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\106765.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108062.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108510421.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108511625.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108511640.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108520718.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108525609.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108545234.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108549421.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108549984.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108584062.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108586421.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108586984.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108597875.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108597937.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108718093.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108719312.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108719328.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108743875.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108745078.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108745531.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108746328.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108747046.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108747484.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108789453.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108789687.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108790125.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108792609.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108793250.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108839640.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108863187.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108865890.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108866500.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108890.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108947625.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108951359.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\108951718.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\109406.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\111203.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\111546.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\111609.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\111750.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\115453.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\115984.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\116078.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\116156.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\117781.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\120234.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123355078.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123355093.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123363578.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123388281.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123391828.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123392375.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123426000.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123427000.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123427546.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123437093.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123437125.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123542609.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123570375.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123571484.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123573578.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123576687.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123578656.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123579093.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123618390.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123618734.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123619703.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123620281.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123662656.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123685328.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123687437.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123688031.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123742671.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123743734.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\123744093.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\125812.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\127640.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\128171.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\130437.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\130625.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\131140.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\135234.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\135765.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\138937.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\140734.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\141281.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\145343.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\147765.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\14823765.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\148250.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\14834859.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\148359.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\14850593.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\14854187.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\14854718.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\14888375.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\14889484.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\14890046.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\14934000.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\149609.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\150062.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\15049437.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\15049453.exe
c:\documents and settings\Belinda Kohry\Application Data\drivers\downld\15058812.exe
c:\documents a

virus_scan_log_panda.txt (420.42 KB)

The attachment preview is chopped off after the first 10 KB. Please download the entire file.

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-12-19 22:45:24
PROTECTIONS: 0
MALWARE: 44
SUSPECTS: 159
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@casalemedia[2].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@doubleclick[2].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@doubleclick[2].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@doubleclick[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.atdmt.com/]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@atdmt[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@atdmt[2].txt
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@atdmt[2].txt
00145405  Cookie/RealMedia                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@247realmedia[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@fastclick[1].txt
00145457  Cookie/FastClick                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@fastclick[2].txt
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@tribalfusion[1].txt
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@tribalfusion[1].txt
00145738  Cookie/Mediaplex                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@mediaplex[1].txt
00147814  Cookie/AspinallsOnlineCasino       TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@pacificpoker[1].txt
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.com.com/]
00167724  Cookie/HotLog                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@hotlog[1].txt
00167749  Cookie/Toplist                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@toplist[1].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@statcounter[2].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@statcounter[2].txt
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@statcounter[1].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@ad.yieldmanager[2].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@ad.yieldmanager[1].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@ad.yieldmanager[2].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@apmebf[1].txt
00168061  Cookie/Apmebf                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@apmebf[1].txt
00168076  Cookie/BurstNet                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@burstnet[2].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\RECYCLER\S-1-5-21-1220945662-725345543-682003330-500\Dc73\Cookies\temp@serving-sys[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@serving-sys[2].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@serving-sys[1].txt
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.serving-sys.com/]
00168090  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@serving-sys[1].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.bs.serving-sys.com/]
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\RECYCLER\S-1-5-21-1220945662-725345543-682003330-500\Dc73\Cookies\temp@bs.serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies1\sandra@bs.serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Belinda Kohry\Cookies\belinda kohry@bs.serving-sys[2].txt
00168093  Cookie/Serving-sys                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Cookies\temp@bs.serving-sys[1].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Documents and Settings\temp.TEMP-4F653CF693\Application Data\Netscape\Navigator\Profiles\u6022o9z.default\cookies.txt[.adtech.de/]
00168109  Cookie/Adtech                      TrackingCookie

cohen 17 Practically a Posting Shark Featured Poster · Answer 5 · 2008-12-23T04:53:53+00:00

Alright, there are still a lot of problems!

====================

*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!

Download CCleaner from here to clean temp files from your computer.

Double click on the file to start the installation of the program.
Select your language and click OK, then next.
Read the license agreement and click I Agree.
Click next to use the default install location. Click Install then finish to complete installation.
Double click the CCleaner shortcut on the desktop to start the program.
Can you pls tick everything on the left hand side!
Then Click, Run CCleaner.
After CCleaner has completed its process, click Exit.

================

Then, can you see if you can run HJT, and post the log in a reply.

================

Pls Note - All Longs that are requested, can you pls post them in a reply.

Thanks,

Cohen

Belinda_k 0 Newbie Poster · Answer 6 · 2008-12-28T13:50:08+00:00

Sorry I havn't replied in a while, I haven't been able to get near my pc over Christmas. Here is my CCleaner log:

CLEANING COMPLETE - (2.460 secs)
------------------------------------------------------------------------------------------
0.65MB removed.
------------------------------------------------------------------------------------------

Details of files deleted
------------------------------------------------------------------------------------------
Marked for deletion: C:\Documents and Settings\jane\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marked for deletion: C:\Documents and Settings\jane\Cookies\index.dat
Marked for deletion: C:\Documents and Settings\jane\Local Settings\History\History.IE5\desktop.ini
Marked for deletion: C:\Documents and Settings\jane\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\jane\Recent\13 O Come All Ye Faithful.wma.lnk 1.09KB
C:\Documents and Settings\jane\Recent\13 Track 13.wma.lnk 1.18KB
C:\Documents and Settings\jane\Recent\29 Mary's boy child.wma.lnk 1.22KB
C:\Documents and Settings\jane\Recent\AUTORUN.INF.lnk 281 bytes
C:\Documents and Settings\jane\Recent\CD Drive.lnk 190 bytes
C:\Documents and Settings\jane\Recent\Unknown Album (3-12-2005 10-01-06 PM)(2).lnk 854 bytes
C:\Documents and Settings\jane\Recent\White Christmas(2).lnk 739 bytes
C:\WINDOWS\system32\wbem\Logs\wbemess.log 9.97KB
C:\WINDOWS\0.log 0 bytes
C:\WINDOWS\WindowsUpdate.log 13.98KB
C:\WINDOWS\ntbtlog.txt 59.99KB
C:\WINDOWS\SchedLgU.Txt 356 bytes
C:\WINDOWS\security\logs\scecomp.old 326 bytes
C:\Documents and Settings\jane\Desktop\Games\Inspector Parker.lnk 809 bytes
C:\Documents and Settings\jane\Desktop\Games\Jigsaw Puzzle Platinum.lnk 773 bytes
C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe 0.20MB
C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.inf 6.38KB
C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\updspapi.dll 0.35MB
------------------------------------------------------------------------------------------

Belinda