This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Outlook PST file with virus: JS.Kak.Gen@mm

36 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi, While using Bit Defender's Online scan it picked up the following Viruus (JS Kak.Gen@MM) and was unable to delete it from 35 files in F:\Documents and Settings\Arnold\Local\Settings\Application\Data\Microsoft\Outlook\Personal Folders(1) Pst… Bit Defender responds that it is unable to disinfect or delete.

I've tried going into Outlook and deleting the individual message folders that contained the RTF docs that it referred to but still am unable to delete the virus. So that is why I've tried to get some support on ridding it. These are the steps I've done on my own as well- I'm pasting my MGlogs.zip file that contains the batch files that were run to determine the status of my drives and hopefully you can use them as well.

Per LD Tate's "Before Posting A Highjacklog " I've done his self help for Windows XP by doing the followoing:
1- Used ATF Cleaner- first in Safe mode so that I could get each seperate account cleaned out. Then mine again in normal startup.
2- Used the most up to date Spybot V 1.5.2, installed the updates and scanned (with no problems found)
3- Checked through the "self-help"(both pages) on Spy/malware removal - none of them addressed the virus that was found.
4-Made sure that I have only one anti-virus program used- Current AVG Anti-Spyware 7.5, most current definitions.
5-Uninstalled previous versions Microsoft's Java and installed Sun Java.
6-Went into MSConfig and setup for Normal startup mode
7-Emptied Recycle Bin-(no quarantined items from spybot or AVG were found
8-Enabled viewing of all hidden files and file extensions
9-Installed and ran "Combofix" (installed on desktop) and MGTools (Root of F-this is my "C drive" (runs runkeyes. newfiles, and Getunkey batch files).

This is my Hijacklog updated

Logfile of HijackThis v1.99.1
Scan saved at 2:03:38 PM, on 2/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\DigitalPersona\Bin\DPWinLct.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\Comodo\Firewall\cmdagent.exe
F:\Program Files\DigitalPersona\Bin\DpHost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
F:\WINDOWS\system32\wscntfy.exe
F:\Program Files\DigitalPersona\Bin\DPAgnt.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
F:\Program Files\HP\HP UT\bin\hppusg.exe
F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
F:\Program Files\V Communications\CD Anywhere\cdawman.exe
F:\Program Files\Microsoft IntelliType Pro\type32.exe
F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
F:\Program Files\Microsoft IntelliPoint\point32.exe
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe
F:\Program Files\Windows Media Player\WMPNSCFG.exe
F:\Program Files\Messenger\msmsgs.exe
F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
F:\Program Files\ATI Multimedia\main\ATIDtct.EXE
F:\WINDOWS\system32\rundll32.exe
F:\WINDOWS\explorer.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Copernic Desktop Search 2 - {968631B6-4729-440D-9BF4-251F5593EC9A} - F:\Program Files\Copernic Desktop Search 2\DesktopSearchBand201013011.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [COMODO Firewall Pro] "F:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [DPAgnt] F:\Program Files\DigitalPersona\Bin\DPAgnt.exe
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] F:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ToolBoxFX] "F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [HPUsageTracking] "F:\Program Files\HP\HP UT\bin\hppusg.exe" "F:\Program Files\HP\HP UT\"
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [cdawman.exe] "F:\Program Files\V Communications\CD Anywhere\cdawman.exe" /startup
O4 - HKLM\..\Run: [type32] "F:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RoxioDragToDisc] F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
O4 - HKLM\..\Run: [NBKeyScan] "F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [IntelliPoint] "F:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [InCD] F:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ATIPTA] F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Copernic Desktop Search 2] "F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
O4 - HKCU\..\Run: [WMPNSCFG] F:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [EasyLinkAdvisor] "F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [ATI Remote Control] F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ATI Launchpad] "F:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] F:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = F:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - F:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/7…can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer…SWebManager.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1200087952063
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201034131875
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://surf1div1.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: DPWLN - F:\WINDOWS\system32\DPWLEvHd.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - F:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - F:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - F:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - F:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - F:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - F:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - F:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)



This is the Combofix log:
ComboFix 08-02.03.1 - Arnold 2008-02-04 11:45:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1522 [GMT -8:00]
Running from: F:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

H:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-02-04 10:13 . 2008-02-04 10:13 d——– F:\Program Files\Common Files\L&H;
2008-02-04 09:47 . 2008-02-04 09:48 d——– F:\MGtools
2008-02-04 09:47 . 2008-02-04 09:48 62,440 –a—— F:\MGlogs.zip
2008-02-04 09:47 . 2005-01-13 19:41 11,254 –a—— F:\WINDOWS\system32\locate.com
2008-02-04 09:03 . 2008-02-04 09:03 d——– F:\Documents and Settings\Arnold\Application Data\Grisoft
2008-02-04 09:03 . 2007-05-30 04:10 10,872 –a—— F:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-04 09:02 . 2008-02-04 09:02 d——– F:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-04 08:37 . 2008-02-04 08:37 d——– F:\Program Files\Spybot - Search & Destroy
2008-02-04 08:21 . 2008-02-04 08:21 1,238,736 –a—— F:\MGtools.exe
2008-02-04 08:12 . 2008-02-04 08:12 d——– F:\Program Files\CCleaner
2008-02-04 08:10 . 2008-02-04 08:10 d——– F:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-04 08:05 . 2008-01-12 18:56 d——– F:\Documents and Settings\Sarah\Application Data\Gtek
2008-02-04 08:05 . 2008-01-12 18:56 d——– F:\Documents and Settings\Laura\Application Data\Gtek
2008-02-04 08:01 . 2008-01-12 18:56 d——– F:\Documents and Settings\Administrator\Application Data\Gtek
2008-02-04 07:55 . 2008-02-04 07:55 d——– F:\Program Files\Yahoo!
2008-02-02 13:51 . 2008-02-02 13:58 d——– F:\Program Files\mIRC
2008-02-02 13:51 . 2008-02-02 14:41 d——– F:\Documents and Settings\Arnold\Application Data\mIRC
2008-02-01 01:07 . 2007-08-01 22:47 102,664 –a—— F:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-31 22:34 . 2008-01-31 23:42 d——– F:\Documents and Settings\Arnold\.housecall6.6
2008-01-31 16:28 . 2008-01-31 16:28 d——– F:\WINDOWS\system32\Kaspersky Lab
2008-01-31 16:28 . 2008-01-31 16:28 d——– F:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-31 11:04 . 2008-01-31 12:18 d——– F:\Program Files\EsetOnlineScanner
2008-01-31 09:37 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\oxdeweugkbwe.sys
2008-01-30 23:19 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\vphaawcprodj.sys
2008-01-30 15:29 . 2008-01-30 15:29 d——– F:\Program Files\Delmar Learning
2008-01-30 15:21 . 2008-01-30 15:23 79,799,972 –a—— F:\CSUN_DIRECTORY_.cdi
2008-01-30 14:42 . 2008-01-30 15:16 2,659,964,545 –a—— F:\Ford DVD.cdi
2008-01-30 14:34 . 2008-01-30 14:37 428,360,977 –a—— F:\Office Disc 2.cdi
2008-01-30 14:30 . 2008-01-30 14:32 326,544,690 –a—— F:\Office Disc 1.cdi
2008-01-30 14:01 . 2008-01-30 14:04 712,508,605 –a—— F:\Windows Xp.cdi
2008-01-30 13:54 . 2008-01-30 13:57 419,421,397 –a—— F:\Pocket PC 2003 Premium w Outlook 2002.cdi
2008-01-30 13:47 . 2008-01-30 13:47 d——– F:\Program Files\V Communications
2008-01-30 13:47 . 2001-08-30 16:26 1,052,672 –a—— F:\WINDOWS\system32\cdawsh.dll
2008-01-30 13:47 . 2001-08-30 16:45 46,864 –a—— F:\WINDOWS\system32\drivers\cdanywhr.sys
2008-01-27 18:47 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\kqbkdepyhmvy.sys
2008-01-27 16:20 . 2008-01-27 16:20 0 –a—— F:\WINDOWS\system32\48F.tmp
2008-01-27 16:19 . 2007-06-05 10:56 44,928 –a—— F:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-27 16:18 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\nlivdkrlakdy.sys
2008-01-27 13:25 . 2008-01-27 14:50 d——– F:\WINDOWS\system32\NtmsData
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\HP
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\Comodo
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\ATI
2008-01-26 17:08 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\Gtek
2008-01-26 17:08 . 2008-01-26 17:08 d——– F:\Documents and Settings\Ally\Application Data\DigitalPersona
2008-01-26 12:33 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\oknxtmifaucr.sys
2008-01-26 10:33 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\vtdoqwbsknqy.sys
2008-01-26 00:45 . 2008-02-04 09:01 d——– F:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-25 22:50 . 2008-02-04 07:24 d——– F:\Program Files\ThreatFire
2008-01-25 22:50 . 2008-02-04 07:23 d-a—— F:\Documents and Settings\All Users\Application Data\TEMP
2008-01-25 22:50 . 2008-01-25 22:50 d——– F:\Documents and Settings\All Users\Application Data\PC Tools
2008-01-25 22:30 . 2008-01-31 09:52 d——– F:\Program Files\Copernic Desktop Search 2
2008-01-25 22:22 . 2008-02-02 08:47 54,156 –ah—– F:\WINDOWS\QTFont.qfn
2008-01-25 22:22 . 2008-01-25 22:22 1,409 ——— F:\WINDOWS\QTFont.for
2008-01-25 20:56 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\yasfpaucqcud.sys
2008-01-25 16:47 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\mfdfvtfdkfia.sys
2008-01-25 15:43 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\cgbepoflmeqv.sys
2008-01-25 15:28 . 2008-01-31 10:07 d——– F:\WINDOWS\system32\ActiveScan
2008-01-25 15:28 . 2008-01-31 09:36 30,590 –a—— F:\WINDOWS\system32\pavas.ico
2008-01-25 15:28 . 2008-01-31 09:36 2,550 –a—— F:\WINDOWS\system32\Uninstall.ico
2008-01-25 15:28 . 2008-01-31 09:36 1,406 –a—— F:\WINDOWS\system32\Help.ico
2008-01-25 11:41 . 2008-02-04 09:52 d——– F:\WINDOWS\BDOSCAN8
2008-01-24 13:32 . 2008-01-24 13:32 d——– F:\Documents and Settings\Arnold\Application Data\HP
2008-01-24 13:32 . 2008-01-24 13:32 d——– F:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-01-24 13:29 . 2008-01-24 13:29 d——– F:\Program Files\Hewlett-Packard
2008-01-24 13:28 . 2008-01-24 13:28 163 ——— F:\WINDOWS\system32\AddPort.ini
2008-01-24 13:21 . 2008-01-24 13:28 747 ——— F:\WINDOWS\hpntwksetup.ini
2008-01-24 13:19 . 2008-01-30 12:56 d——– F:\Program Files\HP
2008-01-24 13:19 . 2004-08-03 23:08 31,616 –a—— F:\WINDOWS\system32\drivers\usbccgp.sys
2008-01-24 13:19 . 2004-08-03 23:08 31,616 —–c— F:\WINDOWS\system32\dllcache\usbccgp.sys
2008-01-24 13:19 . 2004-08-03 23:01 25,856 –a—— F:\WINDOWS\system32\drivers\usbprint.sys
2008-01-24 13:19 . 2004-08-03 23:01 25,856 —–c— F:\WINDOWS\system32\dllcache\usbprint.sys
2008-01-24 13:16 . 2008-01-24 13:33 93,130 ——— F:\WINDOWS\hppins05.dat
2008-01-24 13:16 . 2006-06-01 05:25 896 ——— F:\WINDOWS\hppmdl05.dat
2008-01-24 13:09 . 2008-01-24 13:09 d——– F:\Program Files\Common Files\SWF Studio
2008-01-23 08:57 . 2004-08-04 00:56 221,184 ——— F:\WINDOWS\system32\wmpns.dll
2008-01-23 08:56 . 2008-01-23 09:04 23,392 ——— F:\WINDOWS\system32\nscompat.tlb
2008-01-23 08:56 . 2008-01-23 09:04 16,832 ——— F:\WINDOWS\system32\amcompat.tlb
2008-01-23 00:28 . 2007-07-30 19:19 271,224 ——— F:\WINDOWS\system32\mucltui.dll
2008-01-23 00:28 . 2007-07-30 19:19 30,072 ——— F:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 15:56 . 2008-01-22 15:56 d——– F:\Program Files\Microsoft Silverlight
2008-01-22 15:31 . 2008-01-22 15:31 d——– F:\Program Files\SmartSound Software
2008-01-22 15:31 . 2008-01-22 15:31 d——– F:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2008-01-22 15:27 . 1999-11-10 12:05 86,016 ——— F:\WINDOWS\unvise32qt.exe
2008-01-22 15:26 . 2008-01-22 15:31 d——– F:\WINDOWS\system32\QuickTime
2008-01-22 15:26 . 2008-01-31 09:59 d——– F:\Program Files\QuickTime
2008-01-22 15:26 . 2008-01-22 21:49 d——– F:\Documents and Settings\All Users\Application Data\QuickTime
2008-01-22 15:26 . 2002-03-19 09:29 14,165 ——— F:\WINDOWS\system32\drivers\Pclepci.sys
2008-01-22 15:24 . 2002-01-05 03:48 974,848 ——— F:\WINDOWS\system32\MFC70.DLL
2008-01-22 15:22 . 2008-01-22 15:24 d——– F:\Program Files\Pinnacle
2008-01-22 15:22 . 2008-02-03 20:46 d——– F:\Documents and Settings\All Users\Application Data\Pinnacle
2008-01-22 12:16 . 2008-01-22 12:16 d——– F:\Documents and Settings\Arnold\Application Data\Microsoft Web Folders
2008-01-22 10:46 . 2008-01-22 10:46 d——– F:\Documents and Settings\All Users\Application Data\Goland
2008-01-22 10:19 . 2008-01-22 10:19 d——– F:\Documents and Settings\LocalService\Application Data\Roxio
2008-01-22 10:19 . 2008-01-22 10:20 d——– F:\Documents and Settings\Arnold\Application Data\Roxio
2008-01-22 09:44 . 2008-01-22 09:44 d——– F:\WINDOWS\ASTULogTemp
2008-01-22 09:44 . 2008-01-30 08:49 35,285 –a—— F:\WINDOWS\system32\ASTULog.cab
2008-01-22 09:44 . 2008-01-30 08:49 1,047 –a—— F:\WINDOWS\system32\setup.inf
2008-01-22 09:44 . 2008-01-30 08:49 283 –a—— F:\WINDOWS\system32\setup.rpt
2008-01-22 07:33 . 2008-01-22 07:36 d——– F:\WINDOWS\system32\DLA
2008-01-22 07:33 . 2008-01-22 07:33 d——– F:\Program Files\Common Files\SureThing Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 22:34 ——— d—–w F:\Program Files\microsoft frontpage
2008-01-14 23:31 ——— d—–w F:\Documents and Settings\Arnold\Application Data\.BitTornado
2008-01-11 20:58 ——— d—–w F:\Documents and Settings\All Users\Application Data\ESET
2007-12-21 11:53 2,843,136 —-a-w F:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-21 11:09 368,640 ——w F:\WINDOWS\system32\ATIDEMGX.dll
2007-12-21 11:08 272,384 —-a-w F:\WINDOWS\system32\ati2dvag.dll
2007-12-21 11:02 307,200 ——w F:\WINDOWS\system32\atiiiexx.dll
2007-12-21 10:59 43,520 ——w F:\WINDOWS\system32\ati2edxx.dll
2007-12-21 10:59 26,112 ——w F:\WINDOWS\system32\Ati2mdxx.exe
2007-12-21 10:59 147,456 ——w F:\WINDOWS\system32\atipdlxx.dll
2007-12-21 10:59 122,880 ——w F:\WINDOWS\system32\Oemdspif.dll
2007-12-21 10:58 122,880 ——w F:\WINDOWS\system32\ati2evxx.dll
2007-12-21 10:57 512,000 ——w F:\WINDOWS\system32\ati2evxx.exe
2007-12-21 10:56 53,248 ——w F:\WINDOWS\system32\ATIDDC.DLL
2007-12-21 10:53 9,826,304 ——w F:\WINDOWS\system32\atioglx2.dll
2007-12-21 10:47 3,120,640 —-a-w F:\WINDOWS\system32\ati3duag.dll
2007-12-21 10:36 1,661,696 —-a-w F:\WINDOWS\system32\ativvaxx.dll
2007-12-21 10:24 46,080 ——w F:\WINDOWS\system32\amdpcom32.dll
2007-12-21 10:20 5,435,392 ——w F:\WINDOWS\system32\atioglxx.dll
2007-12-21 10:20 385,024 ——w F:\WINDOWS\system32\atikvmag.dll
2007-12-21 10:18 17,408 ——w F:\WINDOWS\system32\atitvo32.dll
2007-12-21 10:17 49,152 ——w F:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-21 10:15 159,744 ——w F:\WINDOWS\system32\atiok3x2.dll
2007-12-21 10:11 499,712 —-a-w F:\WINDOWS\system32\ati2cqag.dll
2007-12-21 05:05 593,920 ——w F:\WINDOWS\system32\ati2sgag.exe
2007-12-07 18:31 99,712 —-a-w F:\WINDOWS\HPBroker.dll
2007-12-06 17:51 285,952 ——w F:\WINDOWS\system32\drivers\yk51x86.sys
2007-11-07 09:26 721,920 —-a-w F:\WINDOWS\system32\lsasrv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"Copernic Desktop Search 2"="F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" [2007-08-01 10:26 1514016]
"WMPNSCFG"="F:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288]
"swg"="F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [ ]
"MSMSGS"="F:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24 1694208]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [ ]
"EasyLinkAdvisor"="F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 18:16 454784]
"ATI Remote Control"="F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-08-26 23:51 200704]
"ATI Launchpad"="F:\Program Files\ATI Multimedia\main\launchpd.exe" [2004-12-01 15:32 106575]
"ATI DeviceDetect"="F:\Program Files\ATI Multimedia\main\ATIDtct.EXE" [2004-12-01 15:28 69709]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 11:41 24576 F:\WINDOWS\system32\ptipbm.dll]
"COMODO Firewall Pro"="F:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-11 13:18 1115728]
"DPAgnt"="F:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2004-10-13 18:24 913408]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 15:06 118784 F:\WINDOWS\system32\ptipbmf.dll]
"StartCCC"="F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"PinnacleDriverCheck"="F:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 16:26 406016]
"QuickTime Task"="F:\Program Files\QuickTime\qttask.exe" [2008-01-22 15:27 98304]
"ToolBoxFX"="F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-06-15 08:43 49152]
"HPUsageTracking"="F:\Program Files\HP\HP UT\bin\hppusg.exe" [2008-01-26 01:37 36864]
"HP Software Update"="F:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"cdawman.exe"="F:\Program Files\V Communications\CD Anywhere\cdawman.exe" [2001-08-30 16:28 475136]
"type32"="F:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 01:46 196608]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 23:54 65536 F:\WINDOWS\SOUNDMAN.EXE]
"RoxioDragToDisc"="F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-11-15 09:05 1121016]
"NBKeyScan"="F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"MaxtorOneTouch"="F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe" [2004-08-31 09:23 823296]
"IntelliPoint"="F:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 15:26 217088]
"InCD"="F:\Program Files\Ahead\InCD\InCD.exe" [ ]
"ATIPTA"="F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 21:10 344064]
"Adobe Reader Speed Launcher"="F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"Adobe Photo Downloader"="F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 01:18 57344]
"!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25 6731312]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
F:\WINDOWS\system32\DPWLEvHd.dll 2004-10-13 18:29 102400 F:\WINDOWS\system32\DPWLEvHd.dll

R0 viasraid;viasraid;F:\WINDOWS\system32\drivers\viasraid.sys [2003-10-31 03:22]
R1 AmdPPM;AMD HwPState Processor Driver;F:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 21:46]
R1 DLARTL_M;DLARTL_M;F:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-09-15 09:45]
R2 cdanywhr;CD Anywhere Driver;F:\WINDOWS\system32\drivers\cdanywhr.sys [2001-08-30 16:45]
R3 dpK0Bx01;Fingerprint Reader Filter Driver;F:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2004-08-04 16:58]
R3 UsbdpFP;Fingerprint Reader Class Driver;F:\WINDOWS\system32\DRIVERS\UsbdpFP.sys [2004-08-04 16:59]
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);F:\WINDOWS\system32\DRIVERS\A3AB.sys [2007-05-23 04:15]
S3 ICDUSB2;Sony IC Recorder (P);F:\WINDOWS\system32\Drivers\ICDUSB2.sys [2002-11-28 21:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
\Shell\AutoRun\command - "Install FreeAgent Tools.exe" /run

*Newly Created Service* - AVGASCLN
.
Contents of the 'Scheduled Tasks' folder
"2008-01-29 07:00:37 F:\WINDOWS\Tasks\Incremental Back-up.job"
- F:\WINDOWS\system32\ntbackup.exeebackup
"2008-02-04 00:27:29 F:\WINDOWS\Tasks\User_Feed_Synchronization-{329886B2-A930-49D1-977E-BC1CF3378D8C}.job"
- F:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 11:47:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: F:\WINDOWS\explorer.exe [6.00.2900.3156]
-> F:\Program Files\DigitalPersona\Bin\DpOFeedb.dll
-> F:\WINDOWS\system32\DLAAPI_W.DLL
.
Completion time: 2008-02-04 11:48:27
ComboFix-quarantined-files.txt 2008-02-04 19:48:18
ComboFix2.txt 2008-02-04 16:31:47
.
2008-01-27 20:41:59 — E O F —

Attachments:

  • [attachment removed: MGlogs.zip]
I've following the instructions I believe but have a question. #7 states 'When the scan is finished, Click Edit> Select All> Edit> Copy> and paste its contents here please use the"post reply button below'- and there isnt' one. So, after a few days of this post sitting here, is there something else I should be doing since I've yet to see any response. Thanks in advance.
I can remove the infected files I see but this doen't mean it will fix Outlook

Open notepad and copy/paste the text in the quotebox below into it:

File::
F:\WINDOWS\system32\locate.com
F:\WINDOWS\system32\drivers\oxdeweugkbwe.sys
F:\WINDOWS\system32\drivers\vphaawcprodj.sys
F:\WINDOWS\system32\drivers\kqbkdepyhmvy.sys
F:\WINDOWS\system32\48F.tmp
F:\WINDOWS\system32\drivers\nlivdkrlakdy.sys
F:\WINDOWS\system32\drivers\oknxtmifaucr.sys
F:\WINDOWS\system32\drivers\vtdoqwbsknqy.sys
F:\WINDOWS\system32\drivers\yasfpaucqcud.sys
F:\WINDOWS\system32\drivers\mfdfvtfdkfia.sys
F:\WINDOWS\system32\drivers\cgbepoflmeqv.sys

Driver::
oxdeweugkbwe
vphaawcprodj
kqbkdepyhmvy
nlivdkrlakdy
oknxtmifaucr
vtdoqwbsknqy
yasfpaucqcud
mfdfvtfdkfia
cgbepoflmeqv


Save this as Save this as "CFScript"


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Hi LD- As far as Outlook running, if I can fix the virus which is in the backup file, that would be great, but understand that there's no guarantees. That's the rub though- I need what is in outlook as I've been using it so long that I would be hosed- but that said, here is the log you've requested, and other then the issue of the scan, I'm not seeing anything that is out of the ordinary- but I've had this virus for so many years (it was imported from another computer back in 1999 I wouldn't see the difference if you know what I mean ;-)

Logfile of HijackThis v1.99.1
Scan saved at 6:33:02 PM, on 2/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\DigitalPersona\Bin\DPWinLct.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\Comodo\Firewall\cmdagent.exe
F:\Program Files\DigitalPersona\Bin\DpHost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Comodo\Firewall\CPF.exe
F:\Program Files\DigitalPersona\Bin\DPAgnt.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
F:\Program Files\HP\HP UT\bin\hppusg.exe
F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
F:\Program Files\V Communications\CD Anywhere\cdawman.exe
F:\Program Files\Microsoft IntelliType Pro\type32.exe
F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\WINDOWS\system32\wuauclt.exe
F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
F:\Program Files\Microsoft IntelliPoint\point32.exe
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe
F:\Program Files\Windows Media Player\WMPNSCFG.exe
F:\Program Files\Messenger\msmsgs.exe
F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
F:\WINDOWS\system32\rundll32.exe
F:\Program Files\ATI Multimedia\main\launchpd.exe
F:\Program Files\ATI Multimedia\main\ATIDtct.EXE
F:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Copernic Desktop Search 2 - {968631B6-4729-440D-9BF4-251F5593EC9A} - F:\Program Files\Copernic Desktop Search 2\DesktopSearchBand201013011.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [COMODO Firewall Pro] "F:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [DPAgnt] F:\Program Files\DigitalPersona\Bin\DPAgnt.exe
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] F:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ToolBoxFX] "F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [HPUsageTracking] "F:\Program Files\HP\HP UT\bin\hppusg.exe" "F:\Program Files\HP\HP UT\"
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [cdawman.exe] "F:\Program Files\V Communications\CD Anywhere\cdawman.exe" /startup
O4 - HKLM\..\Run: [type32] "F:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RoxioDragToDisc] F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
O4 - HKLM\..\Run: [NBKeyScan] "F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [IntelliPoint] "F:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [InCD] F:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ATIPTA] F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Copernic Desktop Search 2] "F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
O4 - HKCU\..\Run: [WMPNSCFG] F:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [EasyLinkAdvisor] "F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [ATI Remote Control] F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ATI Launchpad] "F:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] F:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = F:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - F:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/7…can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer…SWebManager.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1200087952063
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201034131875
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://surf1div1.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: DPWLN - F:\WINDOWS\system32\DPWLEvHd.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - F:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - F:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - F:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - F:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - F:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - F:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - F:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
The results from Combofix:
ComboFix 08-02.03.1 - Arnold 2008-02-04 18:24:00.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1450 [GMT -8:00]
Running from: F:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: F:\Documents and Settings\Arnold\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
F:\WINDOWS\system32\48F.tmp
F:\WINDOWS\system32\drivers\cgbepoflmeqv.sys
F:\WINDOWS\system32\drivers\kqbkdepyhmvy.sys
F:\WINDOWS\system32\drivers\mfdfvtfdkfia.sys
F:\WINDOWS\system32\drivers\nlivdkrlakdy.sys
F:\WINDOWS\system32\drivers\oknxtmifaucr.sys
F:\WINDOWS\system32\drivers\oxdeweugkbwe.sys
F:\WINDOWS\system32\drivers\vphaawcprodj.sys
F:\WINDOWS\system32\drivers\vtdoqwbsknqy.sys
F:\WINDOWS\system32\drivers\yasfpaucqcud.sys
F:\WINDOWS\system32\locate.com
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\WINDOWS\system32\48F.tmp
F:\WINDOWS\system32\drivers\cgbepoflmeqv.sys
F:\WINDOWS\system32\drivers\kqbkdepyhmvy.sys
F:\WINDOWS\system32\drivers\mfdfvtfdkfia.sys
F:\WINDOWS\system32\drivers\nlivdkrlakdy.sys
F:\WINDOWS\system32\drivers\oknxtmifaucr.sys
F:\WINDOWS\system32\drivers\oxdeweugkbwe.sys
F:\WINDOWS\system32\drivers\vphaawcprodj.sys
F:\WINDOWS\system32\drivers\vtdoqwbsknqy.sys
F:\WINDOWS\system32\drivers\yasfpaucqcud.sys
F:\WINDOWS\system32\locate.com
H:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CGBEPOFLMEQV
——-\LEGACY_KQBKDEPYHMVY
——-\LEGACY_MFDFVTFDKFIA
——-\LEGACY_NLIVDKRLAKDY
——-\LEGACY_OKNXTMIFAUCR
——-\LEGACY_OXDEWEUGKBWE
——-\LEGACY_VPHAAWCPRODJ
——-\LEGACY_VTDOQWBSKNQY
——-\LEGACY_YASFPAUCQCUD
——-\cgbepoflmeqv
——-\kqbkdepyhmvy
——-\mfdfvtfdkfia
——-\nlivdkrlakdy
——-\oknxtmifaucr
——-\oxdeweugkbwe
——-\vphaawcprodj
——-\vtdoqwbsknqy
——-\yasfpaucqcud


((((((((((((((((((((((((( Files Created from 2008-01-05 to 2008-02-05 )))))))))))))))))))))))))))))))
.

2008-02-04 10:13 . 2008-02-04 10:13 d——– F:\Program Files\Common Files\L&H;
2008-02-04 09:47 . 2008-02-04 13:19 d——– F:\MGtools
2008-02-04 09:47 . 2008-02-04 13:19 62,660 –a—— F:\MGlogs.zip
2008-02-04 09:03 . 2008-02-04 09:03 d——– F:\Documents and Settings\Arnold\Application Data\Grisoft
2008-02-04 09:03 . 2007-05-30 04:10 10,872 –a—— F:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-04 09:02 . 2008-02-04 09:02 d——– F:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-04 08:37 . 2008-02-04 08:37 d——– F:\Program Files\Spybot - Search & Destroy
2008-02-04 08:21 . 2008-02-04 08:21 1,238,736 –a—— F:\MGtools.exe
2008-02-04 08:12 . 2008-02-04 08:12 d——– F:\Program Files\CCleaner
2008-02-04 08:10 . 2008-02-04 08:10 d——– F:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-04 08:05 . 2008-01-12 18:56 d——– F:\Documents and Settings\Sarah\Application Data\Gtek
2008-02-04 08:05 . 2008-01-12 18:56 d——– F:\Documents and Settings\Laura\Application Data\Gtek
2008-02-04 08:01 . 2008-01-12 18:56 d——– F:\Documents and Settings\Administrator\Application Data\Gtek
2008-02-04 07:55 . 2008-02-04 07:55 d——– F:\Program Files\Yahoo!
2008-02-02 13:51 . 2008-02-02 13:58 d——– F:\Program Files\mIRC
2008-02-02 13:51 . 2008-02-02 14:41 d——– F:\Documents and Settings\Arnold\Application Data\mIRC
2008-02-01 01:07 . 2007-08-01 22:47 102,664 –a—— F:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-31 22:34 . 2008-01-31 23:42 d——– F:\Documents and Settings\Arnold\.housecall6.6
2008-01-31 16:28 . 2008-01-31 16:28 d——– F:\WINDOWS\system32\Kaspersky Lab
2008-01-31 16:28 . 2008-01-31 16:28 d——– F:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-31 11:04 . 2008-01-31 12:18 d——– F:\Program Files\EsetOnlineScanner
2008-01-30 15:29 . 2008-01-30 15:29 d——– F:\Program Files\Delmar Learning
2008-01-30 15:21 . 2008-01-30 15:23 79,799,972 –a—— F:\CSUN_DIRECTORY_.cdi
2008-01-30 14:42 . 2008-01-30 15:16 2,659,964,545 –a—— F:\Ford DVD.cdi
2008-01-30 14:34 . 2008-01-30 14:37 428,360,977 –a—— F:\Office Disc 2.cdi
2008-01-30 14:30 . 2008-01-30 14:32 326,544,690 –a—— F:\Office Disc 1.cdi
2008-01-30 14:01 . 2008-01-30 14:04 712,508,605 –a—— F:\Windows Xp.cdi
2008-01-30 13:54 . 2008-01-30 13:57 419,421,397 –a—— F:\Pocket PC 2003 Premium w Outlook 2002.cdi
2008-01-30 13:47 . 2008-01-30 13:47 d——– F:\Program Files\V Communications
2008-01-30 13:47 . 2001-08-30 16:26 1,052,672 –a—— F:\WINDOWS\system32\cdawsh.dll
2008-01-30 13:47 . 2001-08-30 16:45 46,864 –a—— F:\WINDOWS\system32\drivers\cdanywhr.sys
2008-01-27 16:19 . 2007-06-05 10:56 44,928 –a—— F:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-27 13:25 . 2008-01-27 14:50 d——– F:\WINDOWS\system32\NtmsData
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\HP
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\Comodo
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\ATI
2008-01-26 17:08 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\Gtek
2008-01-26 17:08 . 2008-01-26 17:08 d——– F:\Documents and Settings\Ally\Application Data\DigitalPersona
2008-01-26 00:45 . 2008-02-04 09:01 d——– F:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-25 22:50 . 2008-02-04 07:24 d——– F:\Program Files\ThreatFire
2008-01-25 22:50 . 2008-02-04 07:23 d-a—— F:\Documents and Settings\All Users\Application Data\TEMP
2008-01-25 22:50 . 2008-01-25 22:50 d——– F:\Documents and Settings\All Users\Application Data\PC Tools
2008-01-25 22:30 . 2008-01-31 09:52 d——– F:\Program Files\Copernic Desktop Search 2
2008-01-25 22:22 . 2008-02-02 08:47 54,156 –ah—– F:\WINDOWS\QTFont.qfn
2008-01-25 22:22 . 2008-01-25 22:22 1,409 ——— F:\WINDOWS\QTFont.for
2008-01-25 15:28 . 2008-01-31 10:07 d——– F:\WINDOWS\system32\ActiveScan
2008-01-25 15:28 . 2008-01-31 09:36 30,590 –a—— F:\WINDOWS\system32\pavas.ico
2008-01-25 15:28 . 2008-01-31 09:36 2,550 –a—— F:\WINDOWS\system32\Uninstall.ico
2008-01-25 15:28 . 2008-01-31 09:36 1,406 –a—— F:\WINDOWS\system32\Help.ico
2008-01-25 11:41 . 2008-02-04 13:20 d——– F:\WINDOWS\BDOSCAN8
2008-01-24 13:32 . 2008-01-24 13:32 d——– F:\Documents and Settings\Arnold\Application Data\HP
2008-01-24 13:32 . 2008-01-24 13:32 d——– F:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-01-24 13:29 . 2008-01-24 13:29 d——– F:\Program Files\Hewlett-Packard
2008-01-24 13:28 . 2008-01-24 13:28 163 ——— F:\WINDOWS\system32\AddPort.ini
2008-01-24 13:21 . 2008-01-24 13:28 747 ——— F:\WINDOWS\hpntwksetup.ini
2008-01-24 13:19 . 2008-01-30 12:56 d——– F:\Program Files\HP
2008-01-24 13:19 . 2004-08-03 23:08 31,616 –a—— F:\WINDOWS\system32\drivers\usbccgp.sys
2008-01-24 13:19 . 2004-08-03 23:08 31,616 —–c— F:\WINDOWS\system32\dllcache\usbccgp.sys
2008-01-24 13:19 . 2004-08-03 23:01 25,856 –a—— F:\WINDOWS\system32\drivers\usbprint.sys
2008-01-24 13:19 . 2004-08-03 23:01 25,856 —–c— F:\WINDOWS\system32\dllcache\usbprint.sys
2008-01-24 13:16 . 2008-01-24 13:33 93,130 ——— F:\WINDOWS\hppins05.dat
2008-01-24 13:16 . 2006-06-01 05:25 896 ——— F:\WINDOWS\hppmdl05.dat
2008-01-24 13:09 . 2008-01-24 13:09 d——– F:\Program Files\Common Files\SWF Studio
2008-01-23 08:57 . 2004-08-04 00:56 221,184 ——— F:\WINDOWS\system32\wmpns.dll
2008-01-23 08:56 . 2008-01-23 09:04 23,392 ——— F:\WINDOWS\system32\nscompat.tlb
2008-01-23 08:56 . 2008-01-23 09:04 16,832 ——— F:\WINDOWS\system32\amcompat.tlb
2008-01-23 00:28 . 2007-07-30 19:19 271,224 ——— F:\WINDOWS\system32\mucltui.dll
2008-01-23 00:28 . 2007-07-30 19:19 30,072 ——— F:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 15:56 . 2008-01-22 15:56 d——– F:\Program Files\Microsoft Silverlight
2008-01-22 15:31 . 2008-01-22 15:31 d——– F:\Program Files\SmartSound Software
2008-01-22 15:31 . 2008-01-22 15:31 d——– F:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2008-01-22 15:27 . 1999-11-10 12:05 86,016 ——— F:\WINDOWS\unvise32qt.exe
2008-01-22 15:26 . 2008-01-22 15:31 d——– F:\WINDOWS\system32\QuickTime
2008-01-22 15:26 . 2008-01-31 09:59 d——– F:\Program Files\QuickTime
2008-01-22 15:26 . 2008-01-22 21:49 d——– F:\Documents and Settings\All Users\Application Data\QuickTime
2008-01-22 15:26 . 2002-03-19 09:29 14,165 ——— F:\WINDOWS\system32\drivers\Pclepci.sys
2008-01-22 15:24 . 2002-01-05 03:48 974,848 ——— F:\WINDOWS\system32\MFC70.DLL
2008-01-22 15:22 . 2008-01-22 15:24 d——– F:\Program Files\Pinnacle
2008-01-22 15:22 . 2008-02-03 20:46 d——– F:\Documents and Settings\All Users\Application Data\Pinnacle
2008-01-22 12:16 . 2008-01-22 12:16 d——– F:\Documents and Settings\Arnold\Application Data\Microsoft Web Folders
2008-01-22 10:46 . 2008-01-22 10:46 d——– F:\Documents and Settings\All Users\Application Data\Goland
2008-01-22 10:19 . 2008-01-22 10:19 d——– F:\Documents and Settings\LocalService\Application Data\Roxio
2008-01-22 10:19 . 2008-01-22 10:20 d——– F:\Documents and Settings\Arnold\Application Data\Roxio
2008-01-22 09:44 . 2008-01-22 09:44 d——– F:\WINDOWS\ASTULogTemp
2008-01-22 09:44 . 2008-01-30 08:49 35,285 –a—— F:\WINDOWS\system32\ASTULog.cab
2008-01-22 09:44 . 2008-01-30 08:49 1,047 –a—— F:\WINDOWS\system32\setup.inf
2008-01-22 09:44 . 2008-01-30 08:49 283 –a—— F:\WINDOWS\system32\setup.rpt
2008-01-22 07:33 . 2008-01-22 07:36 d——– F:\WINDOWS\system32\DLA
2008-01-22 07:33 . 2008-01-22 07:33 d——– F:\Program Files\Common Files\SureThing Shared
2008-01-22 07:33 . 2008-01-22 07:33 d——– F:\Documents and Settings\All Users\Application Data\Sonic
2008-01-22 07:33 . 2008-01-22 07:33 d——– F:\Documents and Settings\All Users\Application Data\InstallShield
2008-01-22 07:33 . 2006-10-25 08:22 99,816 ——— F:\WINDOWS\system32\drivers\DRVMCDB.SYS
2008-01-22 07:33 . 2006-11-01 08:58 92,920 ——— F:\WINDOWS\DLA.EXE
2008-01-22 07:33 . 2006-11-01 08:58 56,056 ——— F:\WINDOWS\system32\DLAAPI_W.DLL
2008-01-22 07:33 . 2006-09-15 09:42 51,768 ——— F:\WINDOWS\system32\drivers\DRVNDDM.SYS
2008-01-22 07:33 . 2006-09-15 09:45 28,184 ——— F:\WINDOWS\system32\drivers\DLARTL_M.SYS
2008-01-22 07:33 . 2006-09-15 09:45 12,920 ——— F:\WINDOWS\system32\drivers\DLACDBHM.SYS
2008-01-22 07:33 . 2008-01-22 07:33 120 ——— F:\WINDOWS\wininit.ini
2008-01-22 07:31 . 2008-01-22 07:33 d——– F:\Program Files\Roxio
2008-01-22 07:31 . 2008-01-22 07:33 d——– F:\Program Files\Common Files\Sonic Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 22:34 ——— d—–w F:\Program Files\microsoft frontpage
2008-01-14 23:31 ——— d—–w F:\Documents and Settings\Arnold\Application Data\.BitTornado
2008-01-11 20:58 ——— d—–w F:\Documents and Settings\All Users\Application Data\ESET
2007-12-21 11:53 2,843,136 —-a-w F:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-21 10:17 49,152 ——w F:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-07 18:31 99,712 —-a-w F:\WINDOWS\HPBroker.dll
2007-12-06 17:51 285,952 ——w F:\WINDOWS\system32\drivers\yk51x86.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"Copernic Desktop Search 2"="F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" [2007-08-01 10:26 1514016]
"WMPNSCFG"="F:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288]
"swg"="F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [ ]
"MSMSGS"="F:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24 1694208]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [ ]
"EasyLinkAdvisor"="F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 18:16 454784]
"ATI Remote Control"="F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-08-26 23:51 200704]
"ATI Launchpad"="F:\Program Files\ATI Multimedia\main\launchpd.exe" [2004-12-01 15:32 106575]
"ATI DeviceDetect"="F:\Program Files\ATI Multimedia\main\ATIDtct.EXE" [2004-12-01 15:28 69709]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 11:41 24576 F:\WINDOWS\system32\ptipbm.dll]
"COMODO Firewall Pro"="F:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-11 13:18 1115728]
"DPAgnt"="F:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2004-10-13 18:24 913408]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 15:06 118784 F:\WINDOWS\system32\ptipbmf.dll]
"StartCCC"="F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"PinnacleDriverCheck"="F:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 16:26 406016]
"QuickTime Task"="F:\Program Files\QuickTime\qttask.exe" [2008-01-22 15:27 98304]
"ToolBoxFX"="F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-06-15 08:43 49152]
"HPUsageTracking"="F:\Program Files\HP\HP UT\bin\hppusg.exe" [2008-01-26 01:37 36864]
"HP Software Update"="F:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"cdawman.exe"="F:\Program Files\V Communications\CD Anywhere\cdawman.exe" [2001-08-30 16:28 475136]
"type32"="F:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 01:46 196608]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 23:54 65536 F:\WINDOWS\SOUNDMAN.EXE]
"RoxioDragToDisc"="F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-11-15 09:05 1121016]
"NBKeyScan"="F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"MaxtorOneTouch"="F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe" [2004-08-31 09:23 823296]
"IntelliPoint"="F:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 15:26 217088]
"InCD"="F:\Program Files\Ahead\InCD\InCD.exe" [ ]
"ATIPTA"="F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 21:10 344064]
"Adobe Reader Speed Launcher"="F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"Adobe Photo Downloader"="F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 01:18 57344]
"!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25 6731312]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
F:\WINDOWS\system32\DPWLEvHd.dll 2004-10-13 18:29 102400 F:\WINDOWS\system32\DPWLEvHd.dll

R0 viasraid;viasraid;F:\WINDOWS\system32\drivers\viasraid.sys [2003-10-31 03:22]
R1 AmdPPM;AMD HwPState Processor Driver;F:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 21:46]
R1 DLARTL_M;DLARTL_M;F:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-09-15 09:45]
R2 cdanywhr;CD Anywhere Driver;F:\WINDOWS\system32\drivers\cdanywhr.sys [2001-08-30 16:45]
R3 dpK0Bx01;Fingerprint Reader Filter Driver;F:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2004-08-04 16:58]
R3 UsbdpFP;Fingerprint Reader Class Driver;F:\WINDOWS\system32\DRIVERS\UsbdpFP.sys [2004-08-04 16:59]
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);F:\WINDOWS\system32\DRIVERS\A3AB.sys [2007-05-23 04:15]
S3 ICDUSB2;Sony IC Recorder (P);F:\WINDOWS\system32\Drivers\ICDUSB2.sys [2002-11-28 21:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
\Shell\AutoRun\command - "Install FreeAgent Tools.exe" /run

.
Contents of the 'Scheduled Tasks' folder
"2008-01-29 07:00:37 F:\WINDOWS\Tasks\Incremental Back-up.job"
- F:\WINDOWS\system32\ntbackup.exeebackup
"2008-02-05 01:52:33 F:\WINDOWS\Tasks\User_Feed_Synchronization-{329886B2-A930-49D1-977E-BC1CF3378D8C}.job"
- F:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 18:28:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: F:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> F:\WINDOWS\system32\DLAAPI_W.DLL
-> F:\Program Files\DigitalPersona\Bin\DpOFeedb.dll
.
———————— Other Running Processes ————————
.
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\DigitalPersona\Bin\DPWinLct.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
F:\Program Files\DigitalPersona\Bin\DpHost.exe
F:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
F:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
F:\Program Files\Windows Media Player\WMPNetwk.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-02-04 18:31:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-05 02:31:42
ComboFix2.txt 2008-02-04 19:48:28
ComboFix3.txt 2008-02-04 16:31:47
.
2008-01-27 20:41:59 — E O F —
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]

    Next:

    Lets run an F-Secure online scan it will scan for Viruses, Spyware and RootKits:
    • Click HERE
    • Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
    • Allow the Active X control to be installed on your computer, then click the Accept button
    • Click Full System Scan and allow the components to download and the scan to complete.
    • If malware is found, check Submit samples to F-Secure then select Automatic cleaning
    • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
    • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
    If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan
    • When the cleaning option is presented, Uncheck Submit samples to F-Secure
    • Click Automatic cleaning
    • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
    • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

    Note: This scan will only work with Internet Explorer.
    You must be logged on a administrator rights to run this scan.
    The scan may take a few hours.

    Also let me know how the computer is running now.
HI LD- as you can see, for some reason this scan wasn't very effective. I did this as a whole system scan and this is what I got- I'll paste for now so that possibly you see something I didn't do- but in the interim will paste this to this thread. This was my third attempt. I'm almost tempted to just do my F and N drives since they are the ones with the infections from what I've seen earlier. Let me know. On the first scan it picked up a virus but hung up while trying to get through my backup of my laptop's image on the N Drive. Most online scans this is an issue- I think I will transfer that file to another drive, and have the scan engine focus on the problem areas for now. It's also possible that my DSL connection is timing out as a result and I'm losing the connection. The reason I believe that is that while trying to open other pages nothing happens and I have to reset my modem. I will reset this again and post when I get a realistic scan showing at LEAST a virus- I know that it's not clean yet as it was there before. Scanning Report Wednesday, February 06, 2008 08:41:47 - 09:24:03 Computer name: MONARCH Scanning type: Scan system for viruses, rootkits, spyware Target: C:\ D:\ F:\ H:\ N:\ ——————————————————————————– Result: 2 malware found Tracking Cookie (spyware) System (Disinfected) System ——————————————————————————– Statistics Scanned: Files: 39440 System: 41919 Not scanned: 3 Actions: Disinfected: 1 Renamed: 0 Deleted: 0 None: 1 Submitted: 0 Files not scanned: F:\PAGEFILE.SYS F:\WINDOWS\SYSTEM32\CONFIG\DEFAULT F:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1735C1EB76EA25D3E576A88900BEBACC_CDA71016-8C3E-434E-B038-F6A168DB2638 ——————————————————————————– Options Scanning engines: F-Secure Libra: 2.4.2, 2008-02-06 F-Secure AVP: 7.0.171, 2008-02-06 F-Secure Orion: 1.2.37, 2008-02-06 F-Secure Blacklight: 1.0.64 F-Secure Draco: 1.0.35, 2008-01-28 F-Secure Pegasus: 1.19.0, 2008-01-04 Scanning options: Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB BAT LNK ANI AVB CEO CMD LSP MAP MHT MIF PDF PHP POT WMF NWS TAR TGZ WSF ZL? {* ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQXJPG SWF Use Advanced heuristics ——————————————————————————– Copyright © 1998-2006 Product support |Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.
Hi LD- this is the results of the last scan: it's not showing the JS.KAK.GEN but this other one in Epson? Weird. I'm running another Full system scan and will see. Scanning Report Wednesday, February 06, 2008 09:48:01 - 12:10:49 Computer name: MONARCH Scanning type: Scan target for viruses, rootkits, spyware Target: N:\ ——————————————————————————– Result: 1 malware found W32/Malware.TXL (virus) N:\Downloads\epson10427.exe\SETUP.EXE\REMOVER.EXE ——————————————————————————– Statistics Scanned: Files: 184922 System: 41927 Not scanned: 25 Actions: Disinfected: 0 Renamed: 0 Deleted: 0 None: 1 Submitted: 0 Files not scanned: N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\5-12-07 MOTORCYCLE REPAIR- PART 1.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\5-19-07 MOTORCYCLE REPAIR 1.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\5-19-07 MOTORCYCLE REPAIR 2.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\5-19-07 MOTORCYCLE REPAIR 3.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\5-26-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\10-11-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\10-16-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\10-2-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\10-25-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\10-9-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\11-1-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\11-1-07B MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\11-13-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\11-15-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\11-15B-07.WAV MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\11-20-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\11-27-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\11-3-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\11-3-07B MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\12-06-07 MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\9-29-07 B MOTORCYCLE REPAIR.MP3 N:\MOTORCYCLE\MOTORCYCLE REPAIR CLASS\FALL CLASS\9-29-07 MOTORCYCLE REPAIR.MP3 N:\Downloads\Pocket PC\XCPUSCALAR\xcpuscalar2007_v3-01_reg.exe\XCPUScalar.arm.CAB bios1.rom C\Documents and Settings\XXXXXXXXX(LD- I"ve edited this out- thus the XXXX\Local Settings\Application Data\Identities\{DBCD3B2E-24CD-4EEF-BB4B-FC02A2A21E60}\Microsoft\Outlook Express\Hotmail - Inbox.dbx ——————————————————————————– Options Scanning engines: F-Secure Libra: 2.4.2, 2008-02-06 F-Secure AVP: 7.0.171, 2008-02-06 F-Secure Orion: 1.2.37, 2008-02-06 F-Secure Blacklight: 1.0.64 F-Secure Draco: 1.0.35, 2008-01-28 F-Secure Pegasus: 1.19.0, 2008-01-04 Scanning options: Scan all files Scan inside archives Use Advanced heuristics ——————————————————————————– Copyright © 1998-2006 Product support |Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.
LD, here is the report that came out when scanning all of the drives- I didn't have any ghost files- but did backup my laptop and it's not an image file- I'll go ahead an re-run bit defender to see what it picks up if anything since this F Secure isn't coming up with anything. But this does concern me when it skips 3 files- "Files not scanned: F:\PAGEFILE.SYS F:\WINDOWS\SYSTEM32\CONFIG\DEFAULT F:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1735C1EB76EA25D3E576A88900BEBACC_CDA71016-8C3E-434E-B038-F6A168DB2638 " Scanning Report Thursday, February 07, 2008 11:02:09 - 11:43:16 Computer name: MONARCH Scanning type: Scan system for viruses, rootkits, spyware Target: C:\ D:\ F:\ H:\ N:\ ——————————————————————————– Result: 0 malware found ——————————————————————————– Statistics Scanned: Files: 42510 System: 42088 Not scanned: 3 Actions: Disinfected: 0 Renamed: 0 Deleted: 0 None: 0 Submitted: 0 Files not scanned: F:\PAGEFILE.SYS F:\WINDOWS\SYSTEM32\CONFIG\DEFAULT F:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1735C1EB76EA25D3E576A88900BEBACC_CDA71016-8C3E-434E-B038-F6A168DB2638 ——————————————————————————– Options Scanning engines: F-Secure Libra: 2.4.2, 2008-02-07 F-Secure AVP: 7.0.171, 2008-02-07 F-Secure Orion: 1.2.37, 2008-02-07 F-Secure Blacklight: 1.0.64 F-Secure Draco: 1.0.35, 2008-01-28 F-Secure Pegasus: 1.19.0, 2008-01-06 Scanning options: Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB BAT LNK ANI AVB CEO CMD LSP MAP MHT MIF PDF PHP POT WMF NWS TAR TGZ WSF ZL? {* ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQXJPG SWF Use Advanced heuristics ——————————————————————————– Copyright © 1998-2006 Product support |Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.
Hi LD- well, bit defender is still finding them. Same thing as before. There are in my documents and settings. Is there anyway to get rid of them from there? I'm pasting what it's found on my drive so far: Statistics Time 00:36:08 Files 283247 Folders 4563 Boot Sectors 8 Archives 2009 Packed Files 30143 Results Identified Viruses 1 Infected Files 35 Suspect Files 0 Warnings 0 Disinfected 0 Deleted Files 35 Engines Info Virus Definitions 979738 Engine build AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36) Scan plugins 16 Archive plugins 41 Unpack plugins 7 E-mail plugins 6 System plugins 5 Scan Settings First Action Disinfect Second Action Delete Heuristics Yes Enable Warnings Yes Scanned Extensions *; Exclude Extensions Scan Emails Yes Scan Archives Yes Scan Packed Yes Scan Files Yes Scan Boot Yes F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Your disc went out today..trade later][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71-Need address][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: RE: "Theres a World" Tree for East-1/21/71-Need address][From: Arnold Levin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Re: "Theres a World" Tree for East-1/21/71][From: Thomas Koons]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf) Update failed F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Infected with: JS.Kak.Gen@mm F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf)=>(Rtf2Html) Deleted F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst=>[Subject: Newbie Tree: Greek Theatre 9/12 show- LEAF- Mid West][From: David Swalin]=>(body)=>(Compressed Rtf) Update failed
Please use the Internet Explorer browser (or FireFox with IETab), and do an online scan with Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
  • Once the files are downloaded click on Next
  • Click on Scan Settings and configure as follows:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:Scan Archives
      Scan Mail Bases
  • Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.
OK- LD, this is what Kapersky came up with: Email-Worm.VBS.KakWorm ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Friday, February 08, 2008 6:38:52 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 8/02/2008 Kaspersky Anti-Virus database records: 554093 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ L:\ M:\ N:\ Scan Statistics: Total number of scanned objects: 165779 Number of viruses found: 3 Number of infected objects: 113 Number of suspicious objects: 0 Duration of the scan process: 02:08:13 Infected Object Name / Virus Name / Last Action C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\Documents and Settings\All Users\Application Data\ATI MMC\RemoteWonder.txt Object is locked skipped F:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1735c1eb76ea25d3e576a88900bebacc_cda71016-8c3e-434e-b038-f6a168db2638 Object is locked skipped F:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped F:\Documents and Settings\Arnold\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\gdql_lsa_LinksysAgent.log Object is locked skipped F:\Documents and Settings\Arnold\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\glog.log Object is locked skipped F:\Documents and Settings\Arnold\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent.log Object is locked skipped F:\Documents and Settings\Arnold\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent_GTActions.log Object is locked skipped F:\Documents and Settings\Arnold\Cookies\index.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\ApplicationHistory\hppusg.exe.e0da306a.ini.inuse Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\ApplicationHistory\HPTLBXFX.exe.2fd6f0a3.ini.inuse Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Index\MainChunk\ChunkSCLF.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Index\MainChunk\DocumentsFD.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Index\MainChunk\DocumentsID.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Index\MainChunk\DocumentsSD.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Index\MainChunk\KeywordsDBT.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Index\MainChunk\KeywordsDL.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Index\MainChunk\KeywordsIBT.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Index\MainChunk\KeywordsP.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Index\MainChunk\KeywordsSBT.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Logs\20080207.log Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Queue\MainChunk\IndexingQueueDf.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Queue\MainChunk\IndexingQueueTt.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Copernic\DesktopSearch2\Queue\MainChunk\IndexingQueueUt.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst/Personal Folders/Inbox/Music/1Traded/Greek/Mid west/17 Oct 2000 05:22 from David Swalin:Newbie Tree: Greek Theatre 9.rtf Infected: Email-Worm.VBS.KakWorm skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Outlook\Personal Folders(1).pst Mail MS Mail: infected - 26 skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\History\History.IE5\index.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Temp\Perflib_Perfdata_878.dat Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Temp\~DF2781.tmp Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Temp\~DF27AE.tmp Object is locked skipped F:\Documents and Settings\Arnold\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped F:\Documents and Settings\Arnold\NTUSER.DAT Object is locked skipped F:\Documents and Settings\Arnold\ntuser.dat.LOG Object is locked skipped F:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped F:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped F:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped F:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped F:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped F:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped F:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped F:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped F:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped F:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped F:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped F:\Pocket PC 2003 Premium w Outlook 2002.cdi Object is locked skipped F:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped F:\Program Files\V Communications\CD Anywhere\cdawman.log Object is locked skipped F:\Program Files\V Communications\CD Anywhere\CDDBCache\cddb.ds Object is locked skipped F:\Program Files\V Communications\CD Anywhere\CDDBCache\D0000000.FCS Object is locked skipped F:\Program Files\V Communications\CD Anywhere\CDDBCache\L0000001.FCS Object is locked skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped F:\WINDOWS\SchedLgU.Txt Object is locked skipped F:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped F:\WINDOWS\Sti_Trace.log Object is locked skipped F:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped F:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped F:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped F:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped F:\WINDOWS\system32\config\default Object is locked skipped F:\WINDOWS\system32\config\default.LOG Object is locked skipped F:\WINDOWS\system32\config\Internet.evt Object is locked skipped F:\WINDOWS\system32\config\SAM Object is locked skipped F:\WINDOWS\system32\config\SAM.LOG Object is locked skipped F:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped F:\WINDOWS\system32\config\SECURITY Object is locked skipped F:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped F:\WINDOWS\system32\config\software Object is locked skipped F:\WINDOWS\system32\config\software.LOG Object is locked skipped F:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped F:\WINDOWS\system32\config\system Object is locked skipped F:\WINDOWS\system32\config\system.LOG Object is locked skipped F:\WINDOWS\system32\h323log.txt Object is locked skipped F:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped F:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped F:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped F:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped F:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped F:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped F:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped F:\WINDOWS\wiadebug.log Object is locked skipped F:\WINDOWS\wiaservc.log Object is locked skipped F:\WINDOWS\WindowsUpdate.log Object is locked skipped H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Downloads\Microsoft\backup2408.pst Mail MS Mail: infected - 25 skipped N:\Downloads\mirc631.exe/stream/data0001/stream/data0014 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped N:\Downloads\mirc631.exe/stream/data0001/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped N:\Downloads\mirc631.exe/stream/data0001 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped N:\Downloads\mirc631.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped N:\Downloads\mirc631.exe NSIS: infected - 4 skipped N:\Downloads\Nero Downloads\Nero-8.2.8.0_eng_trial.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped N:\Downloads\Nero Downloads\Nero-8.2.8.0_eng_trial.exe 7-Zip: infected - 1 skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup.pst Mail MS Mail: infected - 25 skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 21:03 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/01 Aug 2000 02:19 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/31 Jul 2000 23:12 to Thomas Koons:RE: "Theres a World" Tree for .rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst/Personal Folders/Inbox/Music/1Traded/1/21/71 There's a World/U.S./East Coast/29 Jul 2000 16:21 from Thomas Koons:Re: "Theres a World" Tree fo.rtf Infected: Email-Worm.VBS.KakWorm skipped N:\Outlook\backup2408.pst Mail MS Mail: infected - 25 skipped Scan process completed.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI