[Resolved] Hijack Help?

Hello and welcome to the forum.

Sorry about the delay in responding

If you still need help, Scan again with HijackThis, and "copy/paste" a new log file into this thread.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.


Also please describe how your computer behaves at the moment.

Hi

WeatherBug is a system tray icon that offers weather information and includes built-in ads. WeatherBug is controlled by AWS Convergence Technologies (weatherbugmedia.com). There is some controversy over whether WeatherBug should be targeted by anti-parasite software. AWS strongly deny their software is ‘spyware’, and by the definition used here, it is not, as it does not leak information back to its controlling servers. However, WeatherBug has in the past been silently installed by the FavoriteMan parasite and Freeze.com screensavers, and more recently has been bundled by software such as AIM and Blubster. This makes it ‘unsolicited’, and since it is installed to raise money for its creators through the built-in ads it is certainly ‘commercial’. So it does meet the definition for ‘parasite’: unsolicited commercial software. It is nonetheless listed as a borderline case because it is not overtly harmful and many people do install it deliberately. WeatherBug bundles the MySearch parasite in its standalone distribution and has in the past, installed Gator and SVAPlayer.

I recommend that you uninstall WeatherBugand choose one of these alternatives:
Weather Pulse
Weather Watcher
or
Get mozilla Firefox and then get FORECASTFOX!!!
or check the weather at these websites:
Weather Street: US Weather
Intellicast
To uninstall WeatherBug:

• Click Start, point to Settings, and then click Control Panel.
• In Control Panel, double-click Add or Remove Programs.
• In Add or Remove Programs, highlight WeatherBug, click Remove.
• Close the Add or Remove Programs and the Control Panel windows.

Lets run an F-Secure online scan it will scan for Viruses, Spyware and RootKits:

• Click HERE
• Scroll to the bottom of the page and click the Start Scanning button. A window will pop up.
• Allow the Active X control to be installed on your computer, then click the Accept button
• Click Full System Scan and allow the components to download and the scan to complete.
• If malware is found, check Submit samples to F-Secure then select Automatic cleaning
• When cleaning has finished, click Show report (this will open an Internet Explorer window containing the report)
  Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan

• When the cleaning option is presented, Uncheck Submit samples to F-Secure
• Click Automatic cleaning
• When cleaning has finished, click Show report (this will open an Internet Explorer window containing the report)
• Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

Note: This scan will only work with Internet Explorer.
You must be logged on a administrator rights to run this scan.
The scan may take a few hours.

I have followed your instructions, please see below as enerated by running F-Secure. Now what? Thank you very, very much! Scanning Report Friday, April 18, 2008 07:59:41 - 13:33:23 Computer name: DPHLAPTOP Scanning type: Scan system for malware, rootkits Target: C:\ L:\ M:\ ——————————————————————————– Result: 2 malware found AdWare.Win32.BargainBuddy (spyware) System Tracking Cookie (spyware) System ——————————————————————————– Statistics Scanned: Files: 127895 System: 7053 Not scanned: 13 Actions: Disinfected: 0 Renamed: 0 Deleted: 0 None: 2 Submitted: 0 Files not scanned: C:\HIBERFIL.SYS C:\PAGEFILE.SYS C:\WINDOWS\TEMP\MCMSC_5RJ15SCRE4BCSEK C:\WINDOWS\TEMP\MCMSC_H4DZTBE28YFRDOJ C:\WINDOWS\TEMP\MCMSC_TWXHBVGSVW4ELU4 C:\WINDOWS\TEMP\MCMSC_VVEIDQRMJHSK3BY C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT C:\WINDOWS\SYSTEM32\CONFIG\SAM C:\WINDOWS\SYSTEM32\CONFIG\SECURITY C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{44A249A5-1B48-4936-A28B-FB46477BFCFE}.BIN L:\MSDOWNLD.TMP\AS5AB7B4.TMP\ېT?S-+.{H ——————————————————————————– Options Scanning engines: F-Secure USS: 2.30.0 F-Secure Hydra: 2.8.8110, 2008-04-18 F-Secure AVP: 7.0.171, 2008-04-18 F-Secure Pegasus: 1.20.0, 2008-02-28 F-Secure Blacklight: 1.0.64 Scanning options: Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR Use Advanced heuristics ——————————————————————————– Copyright © 1998-2007 Product support |Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

Hi

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.


Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location.
• The log can also be found here:
  C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
• Post that log back here with a new HijackThis log.

Ok, I just one to be absolutley sure Ive got everything, which means another scan. Then we can talk about trimming down your auto-start programs. You have a lot there of unecessary ones.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make sure that the following are selected:
  
  • Scan using the following Anti-Virus database:
    
    + Extended(If available otherwise Standard)
  • Scan Options:
    
    + Scan Archives
    + Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button
• Save the file to your desktop.
• Copy and paste that information in your next post.

With the exception of Internet Explorer, which is needed for the Kaspersky Scan, keep ALL programs closed until the scan is complete. This includes your anti-virus. Once you have installed the Scanner, and the updated definitions, you can disconnect from the Internet.Re-enable the anti-virus before reconnecting to the Internet.

Here is the report. What now? What do I do about the files that the software has identified? Thank you so much for helping me. What do we do about the startup files? Sunday, April 20, 2008 10:10:21 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 19/04/2008 Kaspersky Anti-Virus database records: 715414 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ H:\ K:\ L:\ M:\ Scan Statistics Total number of scanned objects 165520 Number of viruses found 25 Number of infected objects 354 Number of suspicious objects 51 Duration of the scan process 06:09:26 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\Carbonite\Carbonite Backup\Carbonite.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Carbonite\Carbonite Backup\CarboniteConfig.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Carbonite\Carbonite Backup\CarboniteDelta.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Carbonite\Carbonite Backup\CarboniteFiles.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Carbonite\Carbonite Backup\CarboniteNSE.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Carbonite\Carbonite Backup\CarboniteRestores.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Carbonite\Carbonite Backup\CarboniteUI.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Carbonite\Carbonite Backup\CarboniteVersions.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.3 Output\Dana P. Henry\~Running.ping Object is locked skipped C:\Documents and Settings\All Users\Application Data\iolo\FileInfoList\IOLOFIL.FDB Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{97B6E30B-EF2F-4F98-BD98-F645C4534517}.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR3.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\Dana P. Henry\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped C:\Documents and Settings\Dana P. Henry\Application Data\Microsoft\Word\STARTUP\SolidConverterPDF.dot Object is locked skipped C:\Documents and Settings\Dana P. Henry\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Dana P. Henry\Desktop\Download_mbam-setup.exe Infected: not-a-virus:Downloader.Win32.WinFixer.fs skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From Microsoft ][Date Thu, 25 Sep 2003 09:46:04]/UNNAMED/patch.exe Infected: Email-Worm.Win32.Dumaru.a skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From Microsoft ][Date Thu, 25 Sep 2003 09:46:04]/UNNAMED Infected: Email-Worm.Win32.Dumaru.a skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From [removed]][Date Tue, 19 Aug 2003 14:36:24]/UNNAMED/details.pif Infected: Email-Worm.Win32.Sobig.f skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From [removed]][Date Tue, 19 Aug 2003 14:36:24]/UNNAMED Infected: Email-Worm.Win32.Sobig.f skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From [removed]][Date Tue, 19 Aug 2003 15:52:55]/UNNAMED/details.pif Infected: Email-Worm.Win32.Sobig.f skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From [removed]][Date Tue, 19 Aug 2003 15:52:55]/UNNAMED Infected: Email-Worm.Win32.Sobig.f skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From [removed]][Date Tue, 19 Aug 2003 16:30:03]/UNNAMED/document_all.pif Infected: Email-Worm.Win32.Sobig.f skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From [removed]][Date Tue, 19 Aug 2003 16:30:03]/UNNAMED Infected: Email-Worm.Win32.Sobig.f skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From [removed]][Date Wed, 20 Aug 2003 09:23:43]/UNNAMED/details.pif Infected: Email-Worm.Win32.Sobig.f skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx/[From [removed]][Date Wed, 20 Aug 2003 09:23:43]/UNNAMED Infected: Email-Worm.Win32.Sobig.f skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx Mail MS Outlook 5: infected - 10 skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Mon, 26 Jul 2004 23:14:09]/UNNAMED/document_with_notice.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Mon, 26 Jul 2004 23:14:09]/UNNAMED/document_with_notice.zip Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Mon, 26 Jul 2004 23:14:09]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 01:24:04]/UNNAMED/pgp_sess01.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 01:24:04]/UNNAMED/pgp_sess01.zip Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 01:24:04]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From Danlan ][Date Tue, 27 Jul 2004 09:21:54]/UNNAMED/Alive_condom.scr Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From Danlan ][Date Tue, 27 Jul 2004 09:21:54]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 15:40:25]/UNNAMED/mp3music.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 15:40:25]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From Automatic Email Delivery Software ][Date Tue, 27 Jul 2004 11:11:27]/UNNAMED/message.scr Infected: Email-Worm.Win32.Mydoom.m.log skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From Automatic Email Delivery Software ][Date Tue, 27 Jul 2004 11:11:27]/UNNAMED Infected: Email-Worm.Win32.Mydoom.m.log skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 11:18:19]/UNNAMED/document.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 11:18:19]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 11:18:47]/UNNAMED/readme.scr Infected: Email-Worm.Win32.Mydoom.m.log skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 11:18:47]/UNNAMED Infected: Email-Worm.Win32.Mydoom.m.log skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 13:50:50]/UNNAMED/document_4351.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 13:50:50]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 14:18:54]/UNNAMED/your_archive.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 14:18:54]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 15:56:13]/news01.txt Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From Returned mail ][Date Tue, 27 Jul 2004 18:24:56]/UNNAMED/file.scr Infected: Email-Worm.Win32.Mydoom.m skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From Returned mail ][Date Tue, 27 Jul 2004 18:24:56]/UNNAMED Infected: Email-Worm.Win32.Mydoom.m skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 16:10:45]/UNNAMED/readme.exe Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From [removed]][Date Tue, 27 Jul 2004 16:10:45]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From Inchamber ][Date Tue, 27 Jul 2004 22:15:52]/UNNAMED/Readme.scr Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx/[From Inchamber ][Date Tue, 27 Jul 2004 22:15:52]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx Mail MS Outlook 5: infected - 27 skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Inbox.dbx Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Pop3uidl.dbx Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2001.dbx/[From "Michel Foekens" ][Date Wed, 6 Jun 2001 05:47:12 -0400]/DC140.EXE Infected: Email-Worm.Win32.Magistr.a skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2001.dbx Mail MS Outlook 5: infected - 1 skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From RUFFRIDER013 ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From RUFFRIDER013 ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED/done..scr Infected: Email-Worm.Win32.Klez.h skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From RUFFRIDER013 ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From RUFFRIDER013 ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From pyankes ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From pyankes ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED/ebsi.pif Infected: Email-Worm.Win32.Klez.h skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From pyankes ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From pyankes ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From Mailer Daemon ][Date Fri, 31 Oct 2003 15:27:33 -0400 (EST)]/UNNAMED/undelivered.hta Infected: Trojan-Dropper.VBS.Inor.a skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From Mailer Daemon ][Date Fri, 31 Oct 2003 15:27:33 -0400 (EST)]/UNNAMED Infected: Trojan-Dropper.VBS.Inor.a skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From Mail Delivery Subsystem ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED/[From 20.pial1.xdsl.nauticom.net [209.195.147.149]]/UNNAMED/[From dphenry ][Date Fri, 31 Oct 2003 14:40:04 -0500 (EST)]/kitty.exe Infected: Email-Worm.Win32.Klez.h skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From Mail Delivery Subsystem ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED/[From 20.pial1.xdsl.nauticom.net [209.195.147.149]]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx/[From Mail Delivery Subsystem ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx Mail MS Outlook 5: infected - 9, suspicious - 4 skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 08:59:59 -0500]/UNNAMED/document_word.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 08:59:59 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:24 -0500]/UNNAMED/your_letter.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:24 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:47 -0500]/UNNAMED/UNNAMED/[From [removed]][Date Mon, 8 Mar 2004 09:42:47 -0500]/your_letter.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:47 -0500]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:47 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:02:32 -0500]/UNNAMED/product.exe Infected: Email-Worm.Win32.NetSky.b skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:02:32 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.b skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:18:38 -0500]/UNNAMED/your_product.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:18:38 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:44:46 -0500]/UNNAMED/my_details.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:44:46 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:58:02 -0500]/topseller.zip/topseller.scr Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:58:02 -0500]/topseller.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:52:40 -0500]/UNNAMED/posting.zip/posting.pif Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:52:40 -0500]/UNNAMED/posting.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:52:40 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 12:24:38 -0500]/UNNAMED/your_bill.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 12:24:38 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From JHassinger ][Date Mon, 8 Mar 2004 15:48:29 -0500 (EST)]/UNNAMED/href.exe Infected: Email-Worm.Win32.Klez.h skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From JHassinger ][Date Mon, 8 Mar 2004 15:48:29 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 15:57:40 -0500]/UNNAMED/your_text.pif Infected: Email-Worm.Win32.NetSky.j skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 15:57:40 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.j skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From "Microsoft" ][Date Mon, 8 Mar 2004 17:58:49 -0500 (EST)]/patch.exe Infected: Email-Worm.Win32.Dumaru.a skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:50:28 +0530]/UNNAMED/my_details.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:50:28 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From Mail Delivery Subsystem ][Date Tue, 9 Mar 2004 06:00:02 -0800]/UNNAMED/[From 68-232-216-218.pittpa.adelphia.net [68.232.216.218]]/UNNAMED/[From [removed]][Date Mon, 8 Mar 2004 23:08:05 -0500]/your_document.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From Mail Delivery Subsystem ][Date Tue, 9 Mar 2004 06:00:02 -0800]/UNNAMED/[From 68-232-216-218.pittpa.adelphia.net [68.232.216.218]]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From Mail Delivery Subsystem ][Date Tue, 9 Mar 2004 06:00:02 -0800]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:14:54 -0500]/UNNAMED/nomoney.zip/nomoney.htm.com Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:14:54 -0500]/UNNAMED/nomoney.zip Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:14:54 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 16:34:36 +0100]/UNNAMED/your_text.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 16:34:36 +0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 10:42:24 -0500]/document_4351.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 12:20:34 -0500]/UNNAMED/document_4351.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 12:20:34 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 14:04:40 -0500]/UNNAMED/your_letter.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 14:04:40 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 14:40:51 -0500]/UNNAMED/your_text.pif Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 14:40:51 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx Mail MS Outlook 5: infected - 42 skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\pending.dat Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_2240_718D_4071_6905\dfsr.db Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_2240_718D_4071_6905\fsr.log Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_2240_718D_4071_6905\fsrtmp.log Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\Working\database_2240_718D_4071_6905\tmp.edb Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Windows Live Contacts\[removed]\real\members.stg Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Microsoft\Windows Live Contacts\[removed]\shadow\members.stg Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\History\History.IE5\MSHist012008041920080420\index.dat Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\Perflib_Perfdata_17c4.dat Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\Perflib_Perfdata_6f0.dat Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DF1C24.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DF407A.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DF564C.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DF7C5F.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DF8F11.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DF9CD6.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DFAE27.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DFB527.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DFB6F4.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DFBD56.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DFC1E5.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~DFE7CB.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~WRD0004.doc Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~WRF0000.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temp\~WRS0002.tmp Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Dana P. Henry\Local Settings\Temporary Internet Files\Content.IE5\XS0J950D\k[2] Object is locked skipped C:\Documents and Settings\Dana P. Henry\My Documents\April 08 chamber press release.doc Object is locked skipped C:\Documents and Settings\Dana P. Henry\My Documents\March 08 chamber press release.doc Object is locked skipped C:\Documents and Settings\Dana P. Henry\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Dana P. Henry\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{FDF5BC16-BEC4-472F-8F06-7341BFD767A7}\RP982\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{628DBD66-E63A-42CA-A304-91714211D944}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{14DF8356-07DF-41C9-9513-316838424DDE}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\HTTPERR\httperr2.log Object is locked skipped C:\WINDOWS\system32\MsDtc\MSDTC.LOG Object is locked skipped C:\WINDOWS\system32\MsDtc\Trace\dtctrace.log Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\fb_320.lck Object is locked skipped C:\WINDOWS\Temp\mcmsc_1EX5f7f7Ixuyqba Object is locked skipped C:\WINDOWS\Temp\mcmsc_MB18qcEz3iyXjpH Object is locked skipped C:\WINDOWS\Temp\mcmsc_rT0iCqz7Ff1AM90 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped L:\Mail Backup\Deleted Items 2001.dbx/[From "Michel Foekens" ][Date Wed, 6 Jun 2001 05:47:12 -0400]/DC140.EXE Infected: Email-Worm.Win32.Magistr.a skipped L:\Mail Backup\Deleted Items 2001.dbx Mail MS Outlook 5: infected - 1 skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "RUFFRIDER013" ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "RUFFRIDER013" ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED/Done..scr Infected: Email-Worm.Win32.Klez.h skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "RUFFRIDER013" ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "RUFFRIDER013" ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "pyankes" ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "pyankes" ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED/Ebsi.pif Infected: Email-Worm.Win32.Klez.h skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "pyankes" ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "pyankes" ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "Mailer Daemon" ][Date Fri, 31 Oct 2003 15:27:33 -0400 (EST)]/UNNAMED/undelivered.hta Infected: Trojan-Dropper.VBS.Inor.a skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "Mailer Daemon" ][Date Fri, 31 Oct 2003 15:27:33 -0400 (EST)]/UNNAMED Infected: Trojan-Dropper.VBS.Inor.a skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "Mail Delivery Subsystem" ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED/UNNAMED/[From dphenry ][Date Fri, 31 Oct 2003 14:40:04 -0500 (EST)]/kitty.exe Infected: Email-Worm.Win32.Klez.h skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "Mail Delivery Subsystem" ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped L:\Mail Backup\Deleted Items 2003.dbx/[From "Mail Delivery Subsystem" ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped L:\Mail Backup\Deleted Items 2003.dbx Mail MS Outlook 5: infected - 9, suspicious - 4 skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From <[removed]>][Date Tue, 31 Aug 2004 18:42:56 -0400]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From <[removed]>][Date Tue, 31 Aug 2004 18:42:56 -0400]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From <[removed]>][Date Tue, 31 Aug 2004 18:42:56 -0400]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From <[removed]>][Date Tue, 31 Aug 2004 18:42:56 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From "Ckamin" ][Date Tue, 31 Aug 2004 19:16:59 -0500]/UNNAMED/foto.zip/foto.htm Infected: Exploit.HTML.CodeBaseExec skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From "Ckamin" ][Date Tue, 31 Aug 2004 19:16:59 -0500]/UNNAMED/foto.zip/1/calc.exe Infected: Trojan.Win32.Glieder.gen skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From "Ckamin" ][Date Tue, 31 Aug 2004 19:16:59 -0500]/UNNAMED/foto.zip Infected: Trojan.Win32.Glieder.gen skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From "Ckamin" ][Date Tue, 31 Aug 2004 19:16:59 -0500]/UNNAMED Infected: Trojan.Win32.Glieder.gen skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From ][Date Tue, 31 Aug 2004 19:19:34 -0400]/UNNAMED/readme.zip/document.txt .exe Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From ][Date Tue, 31 Aug 2004 19:19:34 -0400]/UNNAMED/readme.zip Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items August 2004.dbx/[From ][Date Tue, 31 Aug 2004 19:19:34 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items August 2004.dbx Mail MS Outlook 5: infected - 9, suspicious - 2 skipped L:\Mail Backup\Deleted Items December 2004.dbx/[From "Suntrust Online support" ][Date Tue, 07 Dec 2004 11:59:12 +0000]/html Infected: Trojan-Spy.HTML.Sunfraud.bf skipped L:\Mail Backup\Deleted Items December 2004.dbx Mail MS Outlook 5: infected - 1 skipped L:\Mail Backup\Deleted Items January 2005.dbx/[From ][Date Wed, 26 Jan 2005 09:16:08 -0600]/UNNAMED/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped L:\Mail Backup\Deleted Items January 2005.dbx/[From ][Date Wed, 26 Jan 2005 09:16:08 -0600]/UNNAMED Suspicious: Trojan-Spy.HTML.Fraud.gen skipped L:\Mail Backup\Deleted Items January 2005.dbx Mail MS Outlook 5: suspicious - 2 skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Wed, 28 Jul 2004 13:33:37 -0700]/UNNAMED/abuse_list.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Wed, 28 Jul 2004 13:33:37 -0700]/UNNAMED/abuse_list.zip Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Wed, 28 Jul 2004 13:33:37 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Webmaster" ][Date Wed, 28 Jul 2004 17:38:02 -0600]/UNNAMED/Manufacture.hta Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Webmaster" ][Date Wed, 28 Jul 2004 17:38:02 -0600]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From <[removed]>][Date Wed, 28 Jul 2004 16:26:44 -0700]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From <[removed]>][Date Wed, 28 Jul 2004 16:26:44 -0700]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From <[removed]>][Date Wed, 28 Jul 2004 16:26:44 -0700]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From <[removed]>][Date Wed, 28 Jul 2004 16:26:44 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Doug" ][Date Wed, 28 Jul 2004 19:25:09 -0500]/UNNAMED/Music_MP3.scr Infected: Email-Worm.Win32.Bagle.ai skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Doug" ][Date Wed, 28 Jul 2004 19:25:09 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.ai skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Inchamber" ][Date Thu, 29 Jul 2004 09:44:25 -0500]/UNNAMED/Information.scr Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Inchamber" ][Date Thu, 29 Jul 2004 09:44:25 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 09:52:50 -0400]/UNNAMED/your_website.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 09:52:50 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 12:47:52 -0400]/UNNAMED/UNNAMED/[From [removed]][Date Thu, 29 Jul 2004 12:54:30 -0400]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 12:47:52 -0400]/UNNAMED/UNNAMED/[From [removed]][Date Thu, 29 Jul 2004 12:54:30 -0400]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 12:47:52 -0400]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 12:47:52 -0400]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 13:14:21 -0400]/UNNAMED/software.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 13:14:21 -0400]/UNNAMED/software.zip Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 13:14:21 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From <[removed]>][Date Thu, 29 Jul 2004 13:20:41 -0400]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From <[removed]>][Date Thu, 29 Jul 2004 13:20:41 -0400]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From <[removed]>][Date Thu, 29 Jul 2004 13:20:41 -0400]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From <[removed]>][Date Thu, 29 Jul 2004 13:20:41 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "System Administrator" ][Date Thu, 29 Jul 2004 11:44:36 -0700]/UNNAMED/UNNAMED/[From [removed]][Date Thu, 29 Jul 2004 11:55:25 -0700]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "System Administrator" ][Date Thu, 29 Jul 2004 11:44:36 -0700]/UNNAMED/UNNAMED/[From [removed]][Date Thu, 29 Jul 2004 11:55:25 -0700]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "System Administrator" ][Date Thu, 29 Jul 2004 11:44:36 -0700]/UNNAMED/UNNAMED/[From [removed]][Date Thu, 29 Jul 2004 11:55:25 -0700]/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "System Administrator" ][Date Thu, 29 Jul 2004 11:44:36 -0700]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "System Administrator" ][Date Thu, 29 Jul 2004 11:44:36 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 14:59:46 -0700]/UNNAMED/websitelist01_dphenry.txt.pif Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 14:59:46 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 15:01:15 -0700]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 15:01:15 -0700]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 15:01:15 -0700]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 29 Jul 2004 15:01:15 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Mon, 26 Jul 2004 09:39:39 -0400]/UNNAMED/your_website.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Mon, 26 Jul 2004 09:39:39 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Mzieger" ][Date Mon, 26 Jul 2004 09:54:59 -0600]/UNNAMED/Details.scr Infected: Email-Worm.Win32.Bagle.af skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Mzieger" ][Date Mon, 26 Jul 2004 09:54:59 -0600]/UNNAMED Infected: Email-Worm.Win32.Bagle.af skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Mon, 26 Jul 2004 12:44:51 -0400]/UNNAMED/your_picture.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Mon, 26 Jul 2004 12:44:51 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Mon, 26 Jul 2004 23:14:09 -0400]/UNNAMED/document_with_notice.zip/data.rtf .scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Mon, 26 Jul 2004 23:14:09 -0400]/UNNAMED/document_with_notice.zip Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Mon, 26 Jul 2004 23:14:09 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Inchamber" ][Date Fri, 30 Jul 2004 00:40:39 -0500]/UNNAMED/Details.exe Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Inchamber" ][Date Fri, 30 Jul 2004 00:40:39 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Mail Administrator" ][Date Fri, 30 Jul 2004 08:07:43 -0400]/letter.zip/letter.zip/letter.scr Infected: Email-Worm.Win32.Mydoom.m skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Mail Administrator" ][Date Fri, 30 Jul 2004 08:07:43 -0400]/letter.zip/letter.zip Infected: Email-Worm.Win32.Mydoom.m skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Mail Administrator" ][Date Fri, 30 Jul 2004 08:07:43 -0400]/letter.zip Infected: Email-Worm.Win32.Mydoom.m skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 08:31:21 -0400]/UNNAMED/message_part2.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 08:31:21 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 09:05:58 -0400]/UNNAMED/my_details.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 09:05:58 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 03:14:54 -0400]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 03:14:54 -0400]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 03:14:54 -0400]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 03:14:54 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Sales" ][Date Fri, 30 Jul 2004 08:55:05 -0500]/UNNAMED/Cat.exe Infected: Email-Worm.Win32.Bagle.ai skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "Sales" ][Date Fri, 30 Jul 2004 08:55:05 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.ai skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 12:15:21 -0400]/UNNAMED/your_text.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 12:15:21 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 07:09:42 -0400]/UNNAMED/document_dphenry.zip/details.txt .pif Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 07:09:42 -0400]/UNNAMED/document_dphenry.zip Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 07:09:42 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 13:03:55 -0700]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 13:03:55 -0700]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 13:03:55 -0700]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Fri, 30 Jul 2004 13:03:55 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "System Administrator" ][Date Fri, 30 Jul 2004 15:54:41 -0400]/UNNAMED/UNNAMED/[From Dphenry ][Date Fri, 30 Jul 2004 17:04:21 -0400]/Info.cpl Infected: Email-Worm.Win32.Bagle.af skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "System Administrator" ][Date Fri, 30 Jul 2004 15:54:41 -0400]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Bagle.af skipped L:\Mail Backup\Deleted Items July 2004.dbx/[From "System Administrator" ][Date Fri, 30 Jul 2004 15:54:41 -0400]/UNNAMED Infected: Email-Worm.Win32.Bagle.af skipped L:\Mail Backup\Deleted Items July 2004.dbx Mail MS Outlook 5: infected - 57, suspicious - 16 skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 10:05:21 -0500]/UNNAMED/ps_friend.doc.exe Infected: Email-Worm.Win32.NetSky.c skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 10:05:21 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 10:12:39 -0500]/UNNAMED/textfile_yours.htm.scr Infected: Email-Worm.Win32.NetSky.c skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 10:12:39 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 13:54:41 -0500]/UNNAMED/your_letter.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 13:54:41 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 14:05:11 -0500]/UNNAMED/yours.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 14:05:11 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 18:22:33 -0500]/UNNAMED/message_details.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 18:22:33 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 20:47:47 -0500]/UNNAMED/website_secrets.htm.exe Infected: Email-Worm.Win32.NetSky.c skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 20:47:47 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 23:36:14 -0500]/UNNAMED/document_full.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sat, 13 Mar 2004 23:36:14 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sun, 14 Mar 2004 00:11:17 -0500]/UNNAMED/your_archive.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Sun, 14 Mar 2004 00:11:17 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Wed, 10 Mar 2004 09:02:48 -0500]/yours.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Thu, 11 Mar 2004 08:58:34 -0500]/UNNAMED/your_bill.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Thu, 11 Mar 2004 08:58:34 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Thu, 11 Mar 2004 15:39:42 -0500]/UNNAMED/final.zip/final.exe Infected: Email-Worm.Win32.NetSky.c skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Thu, 11 Mar 2004 15:39:42 -0500]/UNNAMED/final.zip Infected: Email-Worm.Win32.NetSky.c skipped L:\Mail Backup\Deleted Items March 2004.dbx/[From ][Date Thu, 11 Mar 2004 15:39:42 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped L:\Mail Backup\Deleted Items March 2004.dbx Mail MS Outlook 5: infected - 22 skipped L:\Mail Backup\Deleted Items November 2004 (1).dbx/[From ][Date Tue, 30 Nov 2004 08:37:05 +0000]/html Infected: Trojan-Spy.HTML.Pcard.c skipped L:\Mail Backup\Deleted Items November 2004 (1).dbx/[From =?Windows-1252?Q?eBay=AE_Account_Manager?= ][Date Tue, 30 Nov 2004 06:15:37 -0600]/html Suspicious: Trojan-Spy.HTML.Fraud.gen skipped L:\Mail Backup\Deleted Items November 2004 (1).dbx Mail MS Outlook 5: infected - 1, suspicious - 1 skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Fri, 29 Oct 2004 07:02:31 -0400]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Fri, 29 Oct 2004 07:02:31 -0400]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Fri, 29 Oct 2004 07:02:31 -0400]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Fri, 29 Oct 2004 07:02:31 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sat, 30 Oct 2004 08:29:51 -0400]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sat, 30 Oct 2004 08:29:51 -0400]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sat, 30 Oct 2004 08:29:51 -0400]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sat, 30 Oct 2004 08:29:51 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sat, 30 Oct 2004 08:33:32 -0400]/UNNAMED/abuses_dphenry.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sat, 30 Oct 2004 08:33:32 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sun, 31 Oct 2004 08:26:32 -0500]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sun, 31 Oct 2004 08:26:32 -0500]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sun, 31 Oct 2004 08:26:32 -0500]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sun, 31 Oct 2004 08:26:32 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From <[removed]>][Date Sun, 31 Oct 2004 08:27:38 -0500]/UNNAMED/id09509.exe Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From <[removed]>][Date Sun, 31 Oct 2004 08:27:38 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sun, 31 Oct 2004 14:58:15 -0100]/UNNAMED/photo.zip/document.txt .exe Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sun, 31 Oct 2004 14:58:15 -0100]/UNNAMED/photo.zip Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx/[From ][Date Sun, 31 Oct 2004 14:58:15 -0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items October 2004.dbx Mail MS Outlook 5: infected - 13, suspicious - 6 skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Dmh" ][Date Wed, 29 Sep 2004 21:12:20 -0500]/UNNAMED/Joke.cpl Infected: Email-Worm.Win32.Bagle.as skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Dmh" ][Date Wed, 29 Sep 2004 21:12:20 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.as skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Roumfort" ][Date Thu, 30 Sep 2004 09:46:55 +0100]/UNNAMED/Counter_strike.exe Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Roumfort" ][Date Thu, 30 Sep 2004 09:46:55 +0100]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From <[removed]>][Date Thu, 30 Sep 2004 03:42:41 -0400]/UNNAMED/msg.txt Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From <[removed]>][Date Thu, 30 Sep 2004 03:42:41 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Roumfort" ][Date Thu, 30 Sep 2004 10:38:47 +0100]/UNNAMED/Information.vbs Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Roumfort" ][Date Thu, 30 Sep 2004 10:38:47 +0100]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Verbanac" ][Date Thu, 30 Sep 2004 08:58:17 -0500]/UNNAMED/price.exe Infected: Email-Worm.Win32.Bagle.as skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Verbanac" ][Date Thu, 30 Sep 2004 08:58:17 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.as skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 09:11:27 -0400]/UNNAMED/your_archive.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 09:11:27 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 13:00:52 -0400]/your_picture.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From <[removed]>][Date Thu, 30 Sep 2004 13:18:02 -0400]/UNNAMED/my_details.pif Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From <[removed]>][Date Thu, 30 Sep 2004 13:18:02 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 10:25:15 -0500]/UNNAMED/You_are_dismissed.hta Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 10:25:15 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From <[removed]>][Date Thu, 30 Sep 2004 05:48:08 -0400]/UNNAMED/message.pif Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From <[removed]>][Date Thu, 30 Sep 2004 05:48:08 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 05:51:20 -0400]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 05:51:20 -0400]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 05:51:20 -0400]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 05:51:20 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 05:51:20 -0400]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Arties" ][Date Thu, 30 Sep 2004 12:24:17 -0500]/UNNAMED/Joke.com Infected: Email-Worm.Win32.Bagle.as skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Arties" ][Date Thu, 30 Sep 2004 12:24:17 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.as skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 13:13:16 -0500]/UNNAMED/foto1.zip Infected: Email-Worm.Win32.Bagle.gen skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 13:13:16 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.gen skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 13:32:47 -0500]/UNNAMED/Your_complaint.vbs Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 13:32:47 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 14:11:21 -0500]/UNNAMED/Garry.cpl Infected: Email-Worm.Win32.Bagle.ah skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 14:11:21 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.ah skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 14:23:54 -0500]/UNNAMED/Nervous_illnesses.scr Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "DOCCONWAY" ][Date Thu, 30 Sep 2004 14:23:54 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 14:37:39 -0700]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 14:37:39 -0700]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 14:37:39 -0700]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 14:37:39 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 14:37:46 -0700]/UNNAMED/your_doc.pif Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From ][Date Thu, 30 Sep 2004 14:37:46 -0700]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Inchamber" ][Date Thu, 30 Sep 2004 17:33:05 -0500]/UNNAMED/Loves_money.hta Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx/[From "Inchamber" ][Date Thu, 30 Sep 2004 17:33:05 -0500]/UNNAMED Infected: Email-Worm.Win32.Bagle.z skipped L:\Mail Backup\Deleted Items September 2004.dbx Mail MS Outlook 5: infected - 37, suspicious - 5 skipped L:\System Volume Information\_restore{FDF5BC16-BEC4-472F-8F06-7341BFD767A7}\RP982\change.log Object is locked skipped M:\Mail Backup\Dc101.dbx/[From "Michel Foekens" ][Date Wed, 6 Jun 2001 05:47:12 -0400]/DC140.EXE Infected: Email-Worm.Win32.Magistr.a skipped M:\Mail Backup\Dc101.dbx Mail MS Outlook 5: infected - 1 skipped M:\Mail Backup\Dc106.dbx/[From <[removed]>][Date Tue, 31 Aug 2004 18:42:56 -0400]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\Dc106.dbx/[From <[removed]>][Date Tue, 31 Aug 2004 18:42:56 -0400]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\Dc106.dbx/[From <[removed]>][Date Tue, 31 Aug 2004 18:42:56 -0400]/UNNAMED/message.scr Infected: Email-Worm.Win32.NetSky.q skipped M:\Mail Backup\Dc106.dbx/[From <[removed]>][Date Tue, 31 Aug 2004 18:42:56 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped M:\Mail Backup\Dc106.dbx/[From "Ckamin" ][Date Tue, 31 Aug 2004 19:16:59 -0500]/UNNAMED/foto.zip/foto.htm Infected: Exploit.HTML.CodeBaseExec skipped M:\Mail Backup\Dc106.dbx/[From "Ckamin" ][Date Tue, 31 Aug 2004 19:16:59 -0500]/UNNAMED/foto.zip/1/calc.exe Infected: Trojan.Win32.Glieder.gen skipped M:\Mail Backup\Dc106.dbx/[From "Ckamin" ][Date Tue, 31 Aug 2004 19:16:59 -0500]/UNNAMED/foto.zip Infected: Trojan.Win32.Glieder.gen skipped M:\Mail Backup\Dc106.dbx/[From "Ckamin" ][Date Tue, 31 Aug 2004 19:16:59 -0500]/UNNAMED Infected: Trojan.Win32.Glieder.gen skipped M:\Mail Backup\Dc106.dbx/[From ][Date Tue, 31 Aug 2004 19:19:34 -0400]/UNNAMED/readme.zip/document.txt .exe Infected: Email-Worm.Win32.NetSky.q skipped M:\Mail Backup\Dc106.dbx/[From ][Date Tue, 31 Aug 2004 19:19:34 -0400]/UNNAMED/readme.zip Infected: Email-Worm.Win32.NetSky.q skipped M:\Mail Backup\Dc106.dbx/[From ][Date Tue, 31 Aug 2004 19:19:34 -0400]/UNNAMED Infected: Email-Worm.Win32.NetSky.q skipped M:\Mail Backup\Dc106.dbx Mail MS Outlook 5: infected - 9, suspicious - 2 skipped M:\Mail Backup\deleted archive 1.dbx/[From "RUFFRIDER013" ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\deleted archive 1.dbx/[From "RUFFRIDER013" ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED/Done..scr Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\deleted archive 1.dbx/[From "RUFFRIDER013" ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\deleted archive 1.dbx/[From "RUFFRIDER013" ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\deleted archive 1.dbx/[From "pyankes" ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\deleted archive 1.dbx/[From "pyankes" ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED/Ebsi.pif Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\deleted archive 1.dbx/[From "pyankes" ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\deleted archive 1.dbx/[From "pyankes" ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\deleted archive 1.dbx/[From "Mailer Daemon" ][Date Fri, 31 Oct 2003 15:27:33 -0400 (EST)]/UNNAMED/undelivered.hta Infected: Trojan-Dropper.VBS.Inor.a skipped M:\Mail Backup\deleted archive 1.dbx/[From "Mailer Daemon" ][Date Fri, 31 Oct 2003 15:27:33 -0400 (EST)]/UNNAMED Infected: Trojan-Dropper.VBS.Inor.a skipped M:\Mail Backup\deleted archive 1.dbx/[From "Mail Delivery Subsystem" ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED/UNNAMED/[From dphenry ][Date Fri, 31 Oct 2003 14:40:04 -0500 (EST)]/kitty.exe Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\deleted archive 1.dbx/[From "Mail Delivery Subsystem" ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\deleted archive 1.dbx/[From "Mail Delivery Subsystem" ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\deleted archive 1.dbx Mail MS Outlook 5: infected - 9, suspicious - 4 skipped M:\Mail Backup\Deleted Items 2001.dbx/[From "Michel Foekens" ][Date Wed, 6 Jun 2001 05:47:12 -0400]/DC140.EXE Infected: Email-Worm.Win32.Magistr.a skipped M:\Mail Backup\Deleted Items 2001.dbx Mail MS Outlook 5: infected - 1 skipped M:\Mail Backup\Deleted Items 2003.dbx/[From RUFFRIDER013 ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\Deleted Items 2003.dbx/[From RUFFRIDER013 ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED/done..scr Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\Deleted Items 2003.dbx/[From RUFFRIDER013 ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\Deleted Items 2003.dbx/[From RUFFRIDER013 ][Date Thu, 30 Oct 2003 23:54:18 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\Deleted Items 2003.dbx/[From pyankes ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\Deleted Items 2003.dbx/[From pyankes ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED/ebsi.pif Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\Deleted Items 2003.dbx/[From pyankes ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\Deleted Items 2003.dbx/[From pyankes ][Date Thu, 30 Oct 2003 23:54:34 -0500 (EST)]/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped M:\Mail Backup\Deleted Items 2003.dbx/[From Mailer Daemon ][Date Fri, 31 Oct 2003 15:27:33 -0400 (EST)]/UNNAMED/undelivered.hta Infected: Trojan-Dropper.VBS.Inor.a skipped M:\Mail Backup\Deleted Items 2003.dbx/[From Mailer Daemon ][Date Fri, 31 Oct 2003 15:27:33 -0400 (EST)]/UNNAMED Infected: Trojan-Dropper.VBS.Inor.a skipped M:\Mail Backup\Deleted Items 2003.dbx/[From Mail Delivery Subsystem ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED/[From 20.pial1.xdsl.nauticom.net [209.195.147.149]]/UNNAMED/[From dphenry ][Date Fri, 31 Oct 2003 14:40:04 -0500 (EST)]/kitty.exe Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\Deleted Items 2003.dbx/[From Mail Delivery Subsystem ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED/[From 20.pial1.xdsl.nauticom.net [209.195.147.149]]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\Deleted Items 2003.dbx/[From Mail Delivery Subsystem ][Date Fri, 31 Oct 2003 14:40:15 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\Deleted Items 2003.dbx Mail MS Outlook 5: infected - 9, suspicious - 4 skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 10:05:21 -0500]/UNNAMED/ps_friend.doc.exe Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 10:05:21 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 10:12:39 -0500]/UNNAMED/textfile_yours.htm.scr Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 10:12:39 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 13:54:41 -0500]/UNNAMED/your_letter.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 13:54:41 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 14:05:11 -0500]/UNNAMED/yours.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 14:05:11 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 18:22:33 -0500]/UNNAMED/message_details.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 18:22:33 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 20:47:47 -0500]/UNNAMED/website_secrets.htm.exe Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 20:47:47 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 23:36:14 -0500]/UNNAMED/document_full.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sat, 13 Mar 2004 23:36:14 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sun, 14 Mar 2004 00:11:17 -0500]/UNNAMED/your_archive.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Sun, 14 Mar 2004 00:11:17 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Wed, 10 Mar 2004 09:02:48 -0500]/yours.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 11 Mar 2004 08:58:34 -0500]/UNNAMED/your_bill.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 11 Mar 2004 08:58:34 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 11 Mar 2004 15:39:42 -0500]/UNNAMED/final.zip/final.exe Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 11 Mar 2004 15:39:42 -0500]/UNNAMED/final.zip Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items July 2004.dbx/[From ][Date Thu, 11 Mar 2004 15:39:42 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items July 2004.dbx Mail MS Outlook 5: infected - 22 skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 08:59:59 -0500]/UNNAMED/document_word.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 08:59:59 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:24 -0500]/UNNAMED/your_letter.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:24 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:47 -0500]/UNNAMED/UNNAMED/[From [removed]][Date Mon, 8 Mar 2004 09:42:47 -0500]/your_letter.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:47 -0500]/UNNAMED/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 09:42:47 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:02:32 -0500]/UNNAMED/product.exe Infected: Email-Worm.Win32.NetSky.b skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:02:32 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.b skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:18:38 -0500]/UNNAMED/your_product.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:18:38 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:44:46 -0500]/UNNAMED/my_details.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:44:46 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:58:02 -0500]/topseller.zip/topseller.scr Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:58:02 -0500]/topseller.zip Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:52:40 -0500]/UNNAMED/posting.zip/posting.pif Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:52:40 -0500]/UNNAMED/posting.zip Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 10:52:40 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 12:24:38 -0500]/UNNAMED/your_bill.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 12:24:38 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From JHassinger ][Date Mon, 8 Mar 2004 15:48:29 -0500 (EST)]/UNNAMED/href.exe Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From JHassinger ][Date Mon, 8 Mar 2004 15:48:29 -0500 (EST)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 15:57:40 -0500]/UNNAMED/your_text.pif Infected: Email-Worm.Win32.NetSky.j skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Mon, 8 Mar 2004 15:57:40 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.j skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From "Microsoft" ][Date Mon, 8 Mar 2004 17:58:49 -0500 (EST)]/patch.exe Infected: Email-Worm.Win32.Dumaru.a skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:50:28 +0530]/UNNAMED/my_details.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:50:28 +0530]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From Mail Delivery Subsystem ][Date Tue, 9 Mar 2004 06:00:02 -0800]/UNNAMED/[From 68-232-216-218.pittpa.adelphia.net [68.232.216.218]]/UNNAMED/[From [removed]][Date Mon, 8 Mar 2004 23:08:05 -0500]/your_document.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From Mail Delivery Subsystem ][Date Tue, 9 Mar 2004 06:00:02 -0800]/UNNAMED/[From 68-232-216-218.pittpa.adelphia.net [68.232.216.218]]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From Mail Delivery Subsystem ][Date Tue, 9 Mar 2004 06:00:02 -0800]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:14:54 -0500]/UNNAMED/nomoney.zip/nomoney.htm.com Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:14:54 -0500]/UNNAMED/nomoney.zip Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 09:14:54 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.c skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 16:34:36 +0100]/UNNAMED/your_text.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 16:34:36 +0100]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 10:42:24 -0500]/document_4351.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 12:20:34 -0500]/UNNAMED/document_4351.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 12:20:34 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 14:04:40 -0500]/UNNAMED/your_letter.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 14:04:40 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 14:40:51 -0500]/UNNAMED/your_text.pif Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx/[From [removed]][Date Tue, 9 Mar 2004 14:40:51 -0500]/UNNAMED Infected: Email-Worm.Win32.NetSky.d skipped M:\Mail Backup\Deleted Items March 2004.dbx Mail MS Outlook 5: infected - 42 skipped M:\System Volume Information\1{3808876b-c176-4e48-b7ae-04046e6cc752} Object is locked skipped M:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped M:\System Volume Information\_restore{FDF5BC16-BEC4-472F-8F06-7341BFD767A7}\RP982\change.log Object is locked skipped Scan process completed.

Yowser! I hate emails. Questio- do you have old emails saved that you need to keep or can all go?

I do need to keep the emails, please?

Hi Im just enquiring about a quick way to remove all the infected emails. Shouldnt be too long.

Thank you VERY much! Moving forward, what should I be doing to prevent this situation in the future?

When I post my all-clean speech there will be a link or two about how you got infected and how to avoid it in the future.

Ok, short of getting an reply as yet, I have noticed one thing, that these files were already deleted, but OE still has them stored. But I tested a way of deleting the deleted.

First,
To enable the viewing of Hidden files follow these steps:

• Close all programs so that you are at your desktop.
• Double-click on the My Computer icon (or click Start, then select My Computer)
• Select the Tools menu and click Folder Options.
• After the new window appears select the View tab.
• Put a checkmark in the checkbox labeled Display the contents of system folders.
• Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
• Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
• Remove the checkmark from the checkbox labeled Hide protected operating system files.
• Press the Apply button and then the OK button and shutdown My Computer.
  Now your computer is configured to show all hidden files.

Now navigate to and delete these files. (In bold)
C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Archive.dbx
C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}\Microsoft\Outlook Express\Deleted Items 2004.dbx
C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2001.dbx
C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items 2003.dbx
C:\Documents and Settings\Dana P. Henry\Local Settings\Application Data\Identities\{379361C8-FEAB-4593-BD29-D3B69D1424DA}(2)\Microsoft(2)\Outlook Express(2)\Deleted Items March 2004.dbx
L:\Mail Backup\Deleted Items 2001.dbx
L:\Mail Backup\Deleted Items 2003.dbx
L:\Mail Backup\Deleted Items August 2004.dbx
L:\Mail Backup\Deleted Items January 2005.dbx
L:\Mail Backup\Deleted Items July 2004.dbx
L:\Mail Backup\Deleted Items March 2004.dbx
L:\Mail Backup\Deleted Items November 2004 (1).dbx
L:\Mail Backup\Deleted Items October 2004.dbx
L:\Mail Backup\Deleted Items September 2004.dbx
M:\Mail Backup\Dc101.dbx
M:\Mail Backup\Dc106.dbx
M:\Mail Backup\deleted archive 1.dbx
M:\Mail Backup\Deleted Items 2001.dbx
M:\Mail Backup\Deleted Items 2003.dbx
M:\Mail Backup\Deleted Items July 2004.dbx
M:\Mail Backup\Deleted Items March 2004.dbx

Enjoy!

When you are done with those, update MBAM and run a quick scan then post the new log along with a new HijackThis log, please.