[iglooo101]

Hey iglooo101,
I take it you know about "C:\Program Files\ShariahOne"

Hi emeraldnzl, it was made by Flash9 and needed Adobe Air to run. a buggy standalone application . I just deleted it.
I am running Kaspersky as we speak.
Like you said, folder m1 is full of vermins.

[Advertisements]

Kaspersky can take a long time to run.

Look forward to receiving the scan results when it's finished.

We will attack those bad files after that.

Cheers
emeraldnzl

[emeraldnzl]

Kaspersky can take a long time to run.

Look forward to receiving the scan results when it's finished.

We will attack those bad files after that.

Cheers
emeraldnzl

[iglooo101]

the scanning is 100% complete
here is the result
==========
looks like....it did not scan the whole thing
it is scanning again...
will wait for it to finish the new job
===========

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, August 15, 2008
Operating System: Microsoft Windows Vista Ultimate Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, August 16, 2008 01:11:28
Records in database: 1096789
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 104262
Threat name: 6
Infected objects: 136
Suspicious objects: 0
Duration of the scan: 01:16:20


File name / Threat name / Threats count
C:\Program Files\Analog Devices\Core\smax4pnp.exe Infected: Trojan-Downloader.Win32.Bagle.xz 1
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe Infected: Trojan-Downloader.Win32.Bagle.xz 1
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5495bc1f-42f728a6 Infected: Trojan-Downloader.Java.OpenConnection.aj 2
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5495bc1f-42f728a6 Infected: Exploit.Java.ByteVerify 2
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\538bb179-53ae0789 Infected: Trojan-Downloader.Java.OpenStream.ac 1
C:\Users\suser\AppData\Roaming\m1\flec006.exe Infected: Email-Worm.Win32.Bagle.of 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftBurner 3.1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Email Checker 1.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Submitter 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Webcam Spy 1.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Whois 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCamEditor 5.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Notes Manager CS 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Notes Manager CS2 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Overset Manager CS 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Overset Manager CS2 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCAT Plus Software Database 3.12.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftClan e-cryptor 1.7.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softcode Analog Clock 1.3b.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Digital Clock 1.12.042.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Distance Meter 1.43.043.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection ICQ SMS Sender 1.87.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Impulse Counter 1.15.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LCD Clock 1.99.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LCD Module OCX 1.50.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LED Line 1.16.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Lefthander 1.36.043.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Magnifier 1.0.0.76.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Security System 1.129.041.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Shooting-Range 1.58.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Transparent Analog Clock 1.21.042.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Capture 1.63.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Capture Library For .NET 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Motion Detection Library For .NET.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softcolor photo sledgehammer 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftColor Photo Wizard 0.9.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCopy 1.6.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCopy 3.0.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCuisine 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDeployer 0.6.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Icon Editor 3.0.0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Image Viewer 1.6.0.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Spy Message 1.0.0.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo YouTube Video Grabber 1.0.0.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner BirthdayList 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner Starter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner Unhider 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdetect Network Scanner 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDisc 3.0.2.320.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv Audio Converter 3.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv CD Ripper 3.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv MP3 to WAV Converter 3.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDocket 2006 1.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDownloadz.com Helper 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftE Audio Converter 1.41.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Audio Player 1.41.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Video Player 1.0.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Virtual Printer 1.00.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftEject 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softek Barcode Maker for WIndows 1.1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softek Barcode Reader Toolkit 7.0.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softener 1.26.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softfile 3.05.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SOFTFIRE 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFirst CAD2Image Converter 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFirst DWG-DXF Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFTP 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Nice Tables 1.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Password Generator Free 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Whois 1.8.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftGlobalPhone 2.4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftGuard Register 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftHype 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softi Scan to PDF 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftIC LockPC 1.60.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick 1.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Audio Gateway 1.15.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Blue Files 1.08.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Cache 1.00.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Commander 1.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick PPP 3.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick RAM Drive 1.06.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SofTicker 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftImage ZPIC Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Batch Registry 1.4.0 Build 32.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Favorite Files 2.0.0 Build 85.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Icon Explorer 2.4 Build 92.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Password Safe 1.3.0 Build 39.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Paste Fast 1.2.0 Build 30.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Remind Me! 1.0.0 Build 38.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox RGB Editor 1.4.0 Build 26.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Script Engine 0.3.0 Build 52 (Beta 3).zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinvestor 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftKey Revealer 1.1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftLeds 1.9.0.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softlock.USB 1.2.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftLotto 2.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftMaker Office 2008 Final Beta.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmica Password Manager 1.21.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftmicaCalc 2.13.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmio PDF Converter 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmos Calendar 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftNews Magazine 004.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftNews Weekly News #2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftoDown Bulk PAD Submitter 2.1.918.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softomate Multiple Search 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftOrbits Digital Photo Suite 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftOrbits Html Web Gallery Generator 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softoria Capture 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftoTec BackItUp 1.6.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Christmas Wallpaper Pack 2004a.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Christmas Wallpaper Pack 2004b.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Drivers Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Gadget 0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Games Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Linux Software Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mac Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mobile Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mobile ArchiveSOFTPEDIA SOFTWARE ARCHIVE.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia News 0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Search 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SOFTPEDIA SOFTWARE ARCHIVE.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Webscripts Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper 3GP Video Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD Ripper 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to 3GP Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to AVI Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to iPod Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to iPod Video Suite 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to PSP Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1

The selected area was scanned.

Edited by iglooo101, 15 August 2008 - 08:08 PM.

[emeraldnzl]

Hey iglooo101,

I have to leave for a few hours.

Once you have finished that Kaspersky scan and posted it here my suggestion is that you stay away from your computer as much as possible until we come back with the next step in the process.

Just so you reduce the chance of reinfection as much as possible.

regards
emeraldnzl

[iglooo101]

Hi emeraldnzl,
here is the latest scan

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, August 15, 2008
Operating System: Microsoft Windows Vista Ultimate Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, August 16, 2008 02:32:43
Records in database: 1096940
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 104460
Threat name: 6
Infected objects: 136
Suspicious objects: 0
Duration of the scan: 01:17:15


File name / Threat name / Threats count
C:\Program Files\Analog Devices\Core\smax4pnp.exe Infected: Trojan-Downloader.Win32.Bagle.xz 1
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe Infected: Trojan-Downloader.Win32.Bagle.xz 1
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5495bc1f-42f728a6 Infected: Trojan-Downloader.Java.OpenConnection.aj 2
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5495bc1f-42f728a6 Infected: Exploit.Java.ByteVerify 2
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\538bb179-53ae0789 Infected: Trojan-Downloader.Java.OpenStream.ac 1
C:\Users\suser\AppData\Roaming\m1\flec006.exe Infected: Email-Worm.Win32.Bagle.of 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftBurner 3.1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Email Checker 1.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Submitter 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Webcam Spy 1.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Whois 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCamEditor 5.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Notes Manager CS 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Notes Manager CS2 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Overset Manager CS 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Overset Manager CS2 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCAT Plus Software Database 3.12.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftClan e-cryptor 1.7.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softcode Analog Clock 1.3b.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Digital Clock 1.12.042.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Distance Meter 1.43.043.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection ICQ SMS Sender 1.87.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Impulse Counter 1.15.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LCD Clock 1.99.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LCD Module OCX 1.50.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LED Line 1.16.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Lefthander 1.36.043.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Magnifier 1.0.0.76.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Security System 1.129.041.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Shooting-Range 1.58.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Transparent Analog Clock 1.21.042.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Capture 1.63.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Capture Library For .NET 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Motion Detection Library For .NET.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softcolor photo sledgehammer 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftColor Photo Wizard 0.9.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCopy 1.6.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCopy 3.0.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCuisine 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDeployer 0.6.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Icon Editor 3.0.0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Image Viewer 1.6.0.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Spy Message 1.0.0.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo YouTube Video Grabber 1.0.0.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner BirthdayList 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner Starter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner Unhider 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdetect Network Scanner 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDisc 3.0.2.320.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv Audio Converter 3.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv CD Ripper 3.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv MP3 to WAV Converter 3.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDocket 2006 1.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDownloadz.com Helper 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftE Audio Converter 1.41.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Audio Player 1.41.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Video Player 1.0.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Virtual Printer 1.00.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftEject 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softek Barcode Maker for WIndows 1.1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softek Barcode Reader Toolkit 7.0.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softener 1.26.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softfile 3.05.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SOFTFIRE 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFirst CAD2Image Converter 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFirst DWG-DXF Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFTP 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Nice Tables 1.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Password Generator Free 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Whois 1.8.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftGlobalPhone 2.4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftGuard Register 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftHype 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softi Scan to PDF 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftIC LockPC 1.60.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick 1.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Audio Gateway 1.15.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Blue Files 1.08.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Cache 1.00.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Commander 1.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick PPP 3.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick RAM Drive 1.06.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SofTicker 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftImage ZPIC Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Batch Registry 1.4.0 Build 32.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Favorite Files 2.0.0 Build 85.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Icon Explorer 2.4 Build 92.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Password Safe 1.3.0 Build 39.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Paste Fast 1.2.0 Build 30.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Remind Me! 1.0.0 Build 38.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox RGB Editor 1.4.0 Build 26.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Script Engine 0.3.0 Build 52 (Beta 3).zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinvestor 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftKey Revealer 1.1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftLeds 1.9.0.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softlock.USB 1.2.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftLotto 2.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftMaker Office 2008 Final Beta.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmica Password Manager 1.21.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftmicaCalc 2.13.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmio PDF Converter 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmos Calendar 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftNews Magazine 004.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftNews Weekly News #2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftoDown Bulk PAD Submitter 2.1.918.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softomate Multiple Search 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftOrbits Digital Photo Suite 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftOrbits Html Web Gallery Generator 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softoria Capture 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftoTec BackItUp 1.6.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Christmas Wallpaper Pack 2004a.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Christmas Wallpaper Pack 2004b.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Drivers Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Gadget 0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Games Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Linux Software Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mac Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mobile Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mobile ArchiveSOFTPEDIA SOFTWARE ARCHIVE.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia News 0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Search 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SOFTPEDIA SOFTWARE ARCHIVE.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Webscripts Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper 3GP Video Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD Ripper 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to 3GP Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to AVI Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to iPod Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to iPod Video Suite 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to PSP Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1

The selected area was scanned.
################################################################################
################################################################################
#
################################################################################
#
################################################################################
#
################################################################################
#
################################################################################
#
#################################################################
The vey last scan just in case something moved or multiplied or been overlooked in the previous scans

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Saturday, August 16, 2008
Operating System: Microsoft Windows Vista Ultimate Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, August 16, 2008 04:56:44
Records in database: 1097285
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 104788
Threat name: 6
Infected objects: 136
Suspicious objects: 0
Duration of the scan: 01:17:53


File name / Threat name / Threats count
C:\Program Files\Analog Devices\Core\smax4pnp.exe Infected: Trojan-Downloader.Win32.Bagle.xz 1
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe Infected: Trojan-Downloader.Win32.Bagle.xz 1
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5495bc1f-42f728a6 Infected: Trojan-Downloader.Java.OpenConnection.aj 2
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5495bc1f-42f728a6 Infected: Exploit.Java.ByteVerify 2
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\538bb179-53ae0789 Infected: Trojan-Downloader.Java.OpenStream.ac 1
C:\Users\suser\AppData\Roaming\m1\flec006.exe Infected: Email-Worm.Win32.Bagle.of 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftBurner 3.1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Email Checker 1.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Submitter 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Webcam Spy 1.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Whois 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCamEditor 5.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Notes Manager CS 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Notes Manager CS2 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Overset Manager CS 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Overset Manager CS2 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCAT Plus Software Database 3.12.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftClan e-cryptor 1.7.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softcode Analog Clock 1.3b.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Digital Clock 1.12.042.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Distance Meter 1.43.043.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection ICQ SMS Sender 1.87.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Impulse Counter 1.15.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LCD Clock 1.99.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LCD Module OCX 1.50.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LED Line 1.16.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Lefthander 1.36.043.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Magnifier 1.0.0.76.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Security System 1.129.041.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Shooting-Range 1.58.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Transparent Analog Clock 1.21.042.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Capture 1.63.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Capture Library For .NET 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Motion Detection Library For .NET.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softcolor photo sledgehammer 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftColor Photo Wizard 0.9.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCopy 1.6.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCopy 3.0.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCuisine 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDeployer 0.6.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Icon Editor 3.0.0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Image Viewer 1.6.0.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Spy Message 1.0.0.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo YouTube Video Grabber 1.0.0.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner BirthdayList 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner Starter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner Unhider 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdetect Network Scanner 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDisc 3.0.2.320.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv Audio Converter 3.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv CD Ripper 3.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv MP3 to WAV Converter 3.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDocket 2006 1.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDownloadz.com Helper 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftE Audio Converter 1.41.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Audio Player 1.41.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Video Player 1.0.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Virtual Printer 1.00.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftEject 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softek Barcode Maker for WIndows 1.1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softek Barcode Reader Toolkit 7.0.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softener 1.26.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softfile 3.05.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SOFTFIRE 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFirst CAD2Image Converter 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFirst DWG-DXF Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFTP 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Nice Tables 1.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Password Generator Free 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Whois 1.8.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftGlobalPhone 2.4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftGuard Register 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftHype 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softi Scan to PDF 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftIC LockPC 1.60.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick 1.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Audio Gateway 1.15.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Blue Files 1.08.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Cache 1.00.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Commander 1.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick PPP 3.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick RAM Drive 1.06.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SofTicker 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftImage ZPIC Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Batch Registry 1.4.0 Build 32.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Favorite Files 2.0.0 Build 85.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Icon Explorer 2.4 Build 92.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Password Safe 1.3.0 Build 39.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Paste Fast 1.2.0 Build 30.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Remind Me! 1.0.0 Build 38.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox RGB Editor 1.4.0 Build 26.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Script Engine 0.3.0 Build 52 (Beta 3).zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinvestor 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftKey Revealer 1.1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftLeds 1.9.0.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softlock.USB 1.2.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftLotto 2.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftMaker Office 2008 Final Beta.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmica Password Manager 1.21.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftmicaCalc 2.13.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmio PDF Converter 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmos Calendar 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftNews Magazine 004.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftNews Weekly News #2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftoDown Bulk PAD Submitter 2.1.918.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softomate Multiple Search 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftOrbits Digital Photo Suite 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftOrbits Html Web Gallery Generator 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softoria Capture 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftoTec BackItUp 1.6.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Christmas Wallpaper Pack 2004a.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Christmas Wallpaper Pack 2004b.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Drivers Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Gadget 0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Games Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Linux Software Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mac Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mobile Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mobile ArchiveSOFTPEDIA SOFTWARE ARCHIVE.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia News 0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Search 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SOFTPEDIA SOFTWARE ARCHIVE.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Webscripts Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper 3GP Video Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD Ripper 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to 3GP Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to AVI Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to iPod Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to iPod Video Suite 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to PSP Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1

The selected area was scanned.
################################################################################
################################################################################
#
################################################################################
#
################################################################################
#
################################################################################
#
################################################################################
#
#################################################################

Edited by iglooo101, 16 August 2008 - 12:27 AM.

[emeraldnzl]

Hi iglooo101,

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Users\suser\AppData\Roaming\Mozilla\Firefox\Profiles\xeyrb68t.
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Users\suser\AppData\Roaming\m1

Registry::
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

Sysrst:

Save this as CFScript.txt, in the same location as ComboFix.exe



Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Next

You have had Malwarebytes on your machine. If you still have it please insure it is updated and run it.

If you do not have it now download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

So when you come back please post

• CFSript text
• MBAM scan results
• and tell me how your machine is running now.

[iglooo101]

Hi emeraldnzl,
thank you very much for your help
here is the 1st log, after running combofix

ComboFix 08-08-14.05 - suser 2008-08-16 12:03:06.4 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.1.1033.18.1556 [GMT -4:00]
Running from: C:\xxxwindowCleaners\Combo-Fix.exe
Command switches used :: C:\xxxwindowCleaners\CFScript.txt
* Created a new restore point

FILE ::
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Users\suser\AppData\Roaming\m1
C:\Users\suser\AppData\Roaming\Mozilla\Firefox\Profiles\xeyrb68t.
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\suser@bestbuy[2].txt
C:\Users\suser\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt

.
((((((((((((((((((((((((( Files Created from 2008-07-16 to 2008-08-16 )))))))))))))))))))))))))))))))
.

2008-08-15 04:38 . 2008-08-15 04:38 <DIR> d-------- C:\Program Files\Windows Installer Clean Up
2008-08-14 22:57 . 2008-08-14 22:57 0 -rahs---- C:\$lsdrive$
2008-08-14 22:57 . 2008-08-14 22:57 0 -rahs---- C:\$dwnlvldrive$
2008-08-14 22:57 . 2008-08-14 22:57 0 -rahs---- C:\$bootdrive$
2008-08-14 21:50 . 2008-08-14 22:59 1,887 --a------ C:\Windows\diagwrn.xml
2008-08-14 21:50 . 2008-08-14 22:59 1,887 --a------ C:\Windows\diagerr.xml
2008-08-14 18:31 . 2008-08-14 18:31 <DIR> d-------- C:\Users\suser\AppData\Roaming\Sunbelt
2008-08-14 18:29 . 2008-04-28 14:48 202,160 --a------ C:\Windows\System32\drivers\sbtis.sys
2008-08-14 18:28 . 2008-08-14 18:28 <DIR> d-------- C:\Program Files\Sunbelt Software
2008-08-14 15:17 . 2008-08-14 17:53 <DIR> d-------- C:\Users\suser\AppData\Roaming\m1
2008-08-14 14:59 . 2008-08-14 14:59 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-08-14 14:59 . 2008-08-14 14:59 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-08-14 14:59 . 2008-08-14 14:59 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-14 13:56 . 2008-08-16 12:03 <DIR> d-------- C:\xxxwindowCleaners
2008-08-14 07:40 . 2008-08-14 07:40 <DIR> d-------- C:\Windows\Sun
2008-08-13 14:21 . 2008-07-15 21:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-13 14:07 . 2008-08-13 14:08 <DIR> d-------- C:\Temp\aaaaaMicrosoftANTIvirus
2008-08-13 13:32 . 2008-08-13 13:37 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-08-13 13:25 . 2008-08-13 13:26 <DIR> d-------- C:\Microsoft® Windows® Malicious Software Removal Tool
2008-08-13 13:22 . 2008-08-13 13:23 <DIR> d-------- C:\windowsDefender
2008-08-13 03:02 . 2008-08-14 10:15 <DIR> d-------- C:\Temp\idealratings
2008-08-13 00:25 . 2008-08-13 00:25 <DIR> d--h----- C:\Windows\PIF
2008-08-12 15:27 . 2008-06-18 23:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-12 15:26 . 2008-06-26 21:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-12 15:26 . 2008-06-27 00:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-12 15:26 . 2008-04-10 01:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-12 15:26 . 2008-04-18 01:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-11 21:26 . 2008-08-11 21:26 <DIR> d-------- C:\Users\suser\AppData\Roaming\proDAD
2008-08-11 21:18 . 2008-08-11 21:18 <DIR> d-------- C:\Program Files\Boris FX, Inc
2008-08-11 21:18 . 2003-06-26 10:04 237,568 --------- C:\Windows\System32\qtmlClient.dll
2008-08-11 21:18 . 2003-07-01 16:49 69,632 --------- C:\Windows\System32\MtxPreview.dll
2008-08-11 21:18 . 2003-07-01 16:49 49,152 --------- C:\Windows\System32\MtxParhBFXPreview.dll
2008-08-11 21:18 . 2003-01-20 09:08 49,152 --------- C:\Windows\System32\CvoAPI.dll
2008-08-11 21:18 . 2003-07-09 10:43 45,056 --------- C:\Windows\System32\BFXSrcFilter.ax
2008-08-11 21:18 . 2008-08-15 00:12 2,625 --a------ C:\Windows\Graffiti5.2Pin.ini
2008-08-11 20:48 . 2008-08-11 20:48 <DIR> d-------- C:\Program Files\Common Files\Pinnacle
2008-08-11 20:12 . 2008-08-12 03:08 <DIR> d-------- C:\Program Files\Pinnacle
2008-08-09 13:06 . 2008-08-09 13:06 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-09 13:04 . 2008-08-09 13:05 <DIR> d-------- C:\Program Files\iTunes
2008-08-09 13:04 . 2008-08-09 13:04 <DIR> d-------- C:\Program Files\iPod
2008-08-04 01:16 . 2008-08-04 01:16 <DIR> d-------- C:\Program Files\Common Files\TortoiseOverlays
2008-07-26 09:59 . 2008-07-26 09:59 <DIR> d-------- C:\Program Files\Bonjour
2008-07-25 04:36 . 2008-07-25 04:36 4,816 --------- C:\Windows\System32\divxsm.tlb
2008-07-23 12:48 . 2008-07-23 12:48 1,044,480 --------- C:\Windows\System32\libdivx.dll
2008-07-23 12:48 . 2008-07-23 12:48 200,704 --------- C:\Windows\System32\ssldivx.dll
2008-07-23 12:47 . 2008-07-23 12:47 416 --------- C:\Windows\System32\dtu100.dll.manifest
2008-07-23 12:47 . 2008-07-23 12:47 416 --------- C:\Windows\System32\dpl100.dll.manifest
2008-07-23 12:46 . 2008-07-23 12:46 12,288 --------- C:\Windows\System32\DivXWMPExtType.dll
2008-07-21 22:01 . 2008-07-21 22:01 59,176 --a------ C:\Windows\System32\sbbd.exe
2008-07-18 18:27 . 2008-07-18 18:27 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-07-18 17:30 . 2008-07-18 17:30 <DIR> d-------- C:\Users\suser\AppData\Roaming\ShariahOne.19D89DE8475AF7CD2955032923EA67AE70162BDD.1
2008-07-18 16:32 . 2008-07-18 16:32 <DIR> d-------- C:\Program Files\ShariahOne
2008-07-17 21:08 . 2008-07-17 21:08 <DIR> d-------- C:\Program Files\Sun
2008-07-17 14:58 . 2008-07-17 14:58 <DIR> d-------- C:\Program Files\TechSmith
2008-07-17 13:05 . 2008-07-17 13:05 <DIR> d-------- C:\Program Files\Sling Media

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-16 15:57 --------- d-----w C:\Users\suser\AppData\Roaming\Skype
2008-08-15 08:38 --------- d-----w C:\Program Files\MSECache
2008-08-15 08:23 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-08-15 08:02 --------- d-----w C:\Program Files\MagicISO
2008-08-15 07:55 --------- d-----w C:\Program Files\MagicDisc
2008-08-15 03:55 --------- d-----w C:\ProgramData\eMule
2008-08-14 20:52 --------- d-----w C:\Program Files\eMule
2008-08-14 16:47 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-13 10:51 --------- d-----w C:\Program Files\Windows Mail
2008-08-12 01:09 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-07 10:02 --------- d-----w C:\Program Files\Java
2008-08-07 00:15 --------- d-----w C:\Program Files\DivX
2008-07-27 05:04 --------- d-----w C:\Users\suser\AppData\Roaming\bsplayer
2008-07-25 08:36 524,288 ------w C:\Windows\System32\DivXsm.exe
2008-07-23 16:50 3,596,288 ------w C:\Windows\System32\qt-dx331.dll
2008-07-14 16:05 --------- d-----w C:\Users\suser\AppData\Roaming\InterVideo
2008-07-14 16:03 --------- d-----w C:\ProgramData\InstallShield
2008-07-14 16:02 --------- d-----w C:\Program Files\InterVideo
2008-07-14 16:02 --------- d-----w C:\Program Files\Common Files\InterVideo
2008-07-14 16:02 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-14 14:12 --------- d-----w C:\ProgramData\GRETECH
2008-07-14 14:11 --------- d-----w C:\Users\suser\AppData\Roaming\GRETECH
2008-07-14 14:11 --------- d-----w C:\Program Files\GRETECH
2008-07-13 15:04 --------- d-----w C:\Users\suser\AppData\Roaming\DivX
2008-07-13 04:03 --------- d-----w C:\Program Files\WMV9_VCM
2008-07-13 03:56 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-07-13 03:49 21,764 ------w C:\Windows\System32\CoreAAC-uninstall.exe
2008-07-05 16:40 --------- d-----w C:\Program Files\activePDF
2008-07-04 03:57 --------- d-----w C:\Users\suser\AppData\Roaming\TortoiseSVN
2008-07-02 20:07 --------- d-----w C:\Users\suser\AppData\Roaming\skypePM
2008-07-01 07:07 56 ---ha-w C:\Users\All Users\ezsidmv.dat
2008-07-01 07:07 56 ---ha-w C:\ProgramData\ezsidmv.dat
2008-06-30 10:39 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-29 09:27 --------- d-----w C:\Users\suser\AppData\Roaming\Subversion
2008-06-28 19:42 174 --sha-w C:\Program Files\desktop.ini
2008-06-28 19:29 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-28 19:29 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-06-28 19:29 --------- d-----w C:\Program Files\Windows Journal
2008-06-28 19:29 --------- d-----w C:\Program Files\Windows Defender
2008-06-28 19:29 --------- d-----w C:\Program Files\Windows Collaboration
2008-06-28 19:29 --------- d-----w C:\Program Files\Windows Calendar
2008-06-28 19:11 82,432 ------w C:\Windows\System32\axaltocm.dll
2008-06-28 19:11 101,888 ------w C:\Windows\System32\ifxcardm.dll
2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-12 05:28 541,696 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-06-11 00:07 129,784 ------w C:\Windows\System32\pxafs.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
2008-02-10 02:27 32 ----a-w C:\Users\All Users\ezsid.dat
2008-02-10 02:27 32 ----a-w C:\ProgramData\ezsid.dat
2007-05-04 19:38 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-05-04 19:38 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-05-04 19:38 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 17:52 80384 --a------ C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 03:33 125952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 03:33 202240]
"Jing"="C:\Program Files\TechSmith\Jing\Jing.exe" [2008-07-16 13:44 726272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2006-09-05 19:02 184320]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2006-10-18 09:56 317152]
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2006-10-18 09:32 472800]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648]
"dvd43"="C:\Program Files\dvd43\dvd43_tray.exe" [2007-11-20 17:40 731136]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-23 00:24 620152]

C:\Users\suser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
CCC.lnk - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-09-29 09:57:36 49152]
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-05-01 23:34:15 546816]
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 05:45:42 101784]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2007-11-10 15:48:23 295606]
Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 01:01:50 734872]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-03 17:55:50 703280]
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2008-07-14 11:58:55 184320]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1038192643-3975570624-1541393284-1000]
"EnableNotificationsRef"=dword:00000006

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{FC6ACF01-00C3-42E7-9D80-E3C4DC82DAD1}C:\\program files\\bittyrant\\azureus.exe"= UDP:C:\program files\bittyrant\azureus.exe:Azureus
"UDP Query User{38A7A466-BE6B-4F6D-8467-0D4DBE1CFD7A}C:\\program files\\bittyrant\\azureus.exe"= TCP:C:\program files\bittyrant\azureus.exe:Azureus
"{0A214F54-CA60-4AA7-8F7F-1E6D766E9055}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{AF582C28-CA0B-4779-96A0-119145DCC440}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7C15FE9B-F6DF-4103-ACC8-5A8344F3D1E4}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{E5DBEA06-724F-4EA8-A342-1260EAF5E09D}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{B6078EB2-BE30-489C-AA93-D54BD3718C7B}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{77C54D98-E7B7-40FC-B180-674996920F49}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{D4DCEFE3-AB16-4531-B13C-FD5459BB7231}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{3F714FF8-DB9F-44D3-82D1-3AFDE35556B9}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7E80F5E5-F418-4C3B-B6A4-0714AA5F612B}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{8CFE93AC-275E-42B5-916E-656692C8AACF}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{093CF3BF-D297-4B55-A7B4-0954A3A7E9E6}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{C77F2F15-0A7E-4D2E-845E-AB345164194C}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{8D9109A3-2372-46E1-85F5-9D481EC50346}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{F530D326-CBC1-42EA-9C34-30E22BE07D38}C:\\windows\\system32\\wfs.exe"= UDP:C:\windows\system32\wfs.exe:Microsoft Windows Fax and Scan
"UDP Query User{E8C6F56F-D42F-42D9-8ACB-02C20E7F663C}C:\\windows\\system32\\wfs.exe"= TCP:C:\windows\system32\wfs.exe:Microsoft Windows Fax and Scan
"{C2B626AA-FFCD-42A4-B907-4D5510916682}"= UDP:C:\RECYCLER\msnmrsgrs.exe:RSXB
"{6CABF682-7F75-46CB-8F4A-0F584F38298D}"= TCP:C:\RECYCLER\msnmrsgrs.exe:RSXB
"{B0D72CD0-35F3-40CC-9442-821670EC34F9}"= UDP:6667:irc
"TCP Query User{38F2CD98-F238-4CFA-9476-BC829D08DAAF}C:\\program files\\nero\\nero 7\\nero home\\nerohome.exe"= UDP:C:\program files\nero\nero 7\nero home\nerohome.exe:Nero Home
"UDP Query User{0A80F3F8-6110-400A-BD27-D18918B2CAD7}C:\\program files\\nero\\nero 7\\nero home\\nerohome.exe"= TCP:C:\program files\nero\nero 7\nero home\nerohome.exe:Nero Home
"TCP Query User{3253EA1D-4230-44F9-9A56-018AABD481F3}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{DB754407-39EA-482A-980B-79433272367D}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{CD8867EE-1DC5-4ACB-979F-FAE65BA03C68}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{E4C3D8EA-6EE5-4F40-85B2-BAE67A495306}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{4D6BE946-732C-43EA-BEF0-D8CD406578FC}"= C:\Program Files\Skype\Phone\Skype.exe:Skype
"TCP Query User{162B6780-4DCD-445F-B04F-0128C7FA1634}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{BF07BD08-7F60-45B4-83B5-700C77C738FC}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"{39D4B611-6F72-4764-9B17-36DA79ABC7B7}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{5B1A2FB0-E02A-485B-B440-619A47BA6AAA}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{766B3510-DDA0-4B8E-A55D-8C2A780A6267}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{F998642C-5829-4A2F-B68A-9CF22F90C6DD}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{86D739D2-6258-4A5A-8F77-F153FC021A72}"= UDP:F:\Program Files\Pinnacle\Studio 12\Programs\RM.exe:Render Manager
"{34846A13-4D18-4BC6-8872-AE2908110E73}"= TCP:F:\Program Files\Pinnacle\Studio 12\Programs\RM.exe:Render Manager
"{DBCC0485-993E-4A38-93B1-42847A0AB779}"= UDP:F:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe:Studio
"{713939AA-9272-47B4-8D2F-A7D02700C3F0}"= TCP:F:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe:Studio
"{AFDCDF01-2DC5-498D-A090-0495356474CC}"= UDP:F:\Program Files\Pinnacle\Studio 12\Programs\umi.exe:umi
"{5C629682-8CC4-4B3F-BD57-4F805D571936}"= TCP:F:\Program Files\Pinnacle\Studio 12\Programs\umi.exe:umi

R1 sbtis;sbtis;C:\Windows\system32\drivers\sbtis.sys [2008-04-28 14:48]
R3 b57nd60x;%SvcDispName%;C:\Windows\system32\DRIVERS\b57nd60x.sys [2008-01-19 00:25]
R3 HSX_DPV;HSX_DPV;C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-12-13 13:51]
S2 SBAMSvc;Sunbelt VIPRE Antivirus Service;C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe []
S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2006-11-21 12:54]
S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2006-11-21 12:54]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2006-11-21 12:54]
S3 MREMP50;MREMP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [2007-01-19 12:53]
S3 MRESP50;MRESP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [2007-01-19 12:53]
S3 Pscdeiddpu;Pscdeiddpu;C:\Windows\system32\drivers\afd.sys [2008-01-19 01:57]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {B8D03542-FFB4-8617-0686-40DF3B577C64} /qb
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-16 12:06:15
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-16 12:07:44
ComboFix-quarantined-files.txt 2008-08-16 16:07:39
ComboFix2.txt 2008-08-15 23:47:00

Pre-Run: 53,346,832,384 bytes free
Post-Run: 53,390,180,352 bytes free

293 --- E O F --- 2008-08-14 16:47:35
################################################################################
################################################################################
#
################################################################################
#
############################################################################

2 - here is the log by Malwarebytes
btw Malwarebytes did not ask to restart the computer...I will restart anywat to see what happens...................


Malwarebytes' Anti-Malware 1.24
Database version: 1058
Windows 6.0.6001 Service Pack 1

12:23:51 PM 8/16/2008
mbam-log-8-16-2008 (12-23-51).txt

Scan type: Quick Scan
Objects scanned: 36822
Time elapsed: 3 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\wextract.exe (Adware.Buzus) -> Quarantined and deleted successfully.
################################################################################
################################################################################
################################################################################
############################################################################

Edited by iglooo101, 16 August 2008 - 10:43 AM.

[iglooo101]

Hi emeraldnzl,
AGAIN thank you very much for your help
I really thank you
here is another scan, I will go to kaspersky to perform an additional scan

edit to say...will open a new thread for that
..................My Hard Disk is the source of infection any ideas on how to disinfect ???



Malwarebytes' Anti-Malware 1.24
Database version: 1058
Windows 6.0.6001 Service Pack 1

12:40:18 PM 8/16/2008
mbam-log-8-16-2008 (12-40-18).txt

Scan type: Quick Scan
Objects scanned: 36975
Time elapsed: 7 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Edited by iglooo101, 16 August 2008 - 12:22 PM.

[iglooo101]

Hi emeraldnzl,
right now I am at
http://www.kaspersky...n=1218905751595
doing a fresh scan of my system
here is what the screen says....
will post a log of the results as soon as the full scan is done
looks like my system is not 100% clean
we are down by
1 threat
2 infected objects
#######################################
Scan My ComputerScan statistics
Files scanned 63569
Threat names 5
Infected objects 134
Suspicious objects 0
#######################################

Edited by iglooo101, 16 August 2008 - 12:04 PM.

[iglooo101]

Hi emeraldnzl,
here is the report from kaspersky

########################################################################
########################################################################
########################################################################
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Saturday, August 16, 2008
Operating System: Microsoft Windows Vista Ultimate Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, August 16, 2008 17:48:07
Records in database: 1098711
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 104315
Threat name: 5
Infected objects: 134
Suspicious objects: 0
Duration of the scan: 01:18:32


File name / Threat name / Threats count
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5495bc1f-42f728a6 Infected: Trojan-Downloader.Java.OpenConnection.aj 2
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\5495bc1f-42f728a6 Infected: Exploit.Java.ByteVerify 2
C:\Users\suser\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\538bb179-53ae0789 Infected: Trojan-Downloader.Java.OpenStream.ac 1
C:\Users\suser\AppData\Roaming\m1\flec006.exe Infected: Email-Worm.Win32.Bagle.of 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftBurner 3.1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Email Checker 1.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Submitter 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Webcam Spy 1.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCab Whois 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCamEditor 5.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Notes Manager CS 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Notes Manager CS2 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Overset Manager CS 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCare Overset Manager CS2 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCAT Plus Software Database 3.12.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftClan e-cryptor 1.7.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softcode Analog Clock 1.3b.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Digital Clock 1.12.042.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Distance Meter 1.43.043.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection ICQ SMS Sender 1.87.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Impulse Counter 1.15.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LCD Clock 1.99.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LCD Module OCX 1.50.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection LED Line 1.16.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Lefthander 1.36.043.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Magnifier 1.0.0.76.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Security System 1.129.041.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Shooting-Range 1.58.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Transparent Analog Clock 1.21.042.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Capture 1.63.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Capture Library For .NET 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCollection Video Motion Detection Library For .NET.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softcolor photo sledgehammer 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftColor Photo Wizard 0.9.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCopy 1.6.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCopy 3.0.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftCuisine 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDeployer 0.6.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Icon Editor 3.0.0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Image Viewer 1.6.0.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo Spy Message 1.0.0.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDepo YouTube Video Grabber 1.0.0.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner BirthdayList 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner Starter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDesigner Unhider 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdetect Network Scanner 4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDisc 3.0.2.320.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv Audio Converter 3.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv CD Ripper 3.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softdiv MP3 to WAV Converter 3.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDocket 2006 1.5.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftDownloadz.com Helper 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftE Audio Converter 1.41.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Audio Player 1.41.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Video Player 1.0.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softe Virtual Printer 1.00.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftEject 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softek Barcode Maker for WIndows 1.1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softek Barcode Reader Toolkit 7.0.3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softener 1.26.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softfile 3.05.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SOFTFIRE 2.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFirst CAD2Image Converter 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFirst DWG-DXF Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFTP 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Nice Tables 1.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Password Generator Free 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftFuse Whois 1.8.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftGlobalPhone 2.4.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftGuard Register 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftHype 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softi Scan to PDF 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftIC LockPC 1.60.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick 1.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Audio Gateway 1.15.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Blue Files 1.08.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Cache 1.00.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick Commander 1.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick PPP 3.02.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softick RAM Drive 1.06.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SofTicker 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftImage ZPIC Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Batch Registry 1.4.0 Build 32.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Favorite Files 2.0.0 Build 85.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Icon Explorer 2.4 Build 92.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Password Safe 1.3.0 Build 39.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Paste Fast 1.2.0 Build 30.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Remind Me! 1.0.0 Build 38.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox RGB Editor 1.4.0 Build 26.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinabox Script Engine 0.3.0 Build 52 (Beta 3).zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softinvestor 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftKey Revealer 1.1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftLeds 1.9.0.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softlock.USB 1.2.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftLotto 2.4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftMaker Office 2008 Final Beta.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmica Password Manager 1.21.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftmicaCalc 2.13.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmio PDF Converter 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softmos Calendar 1.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftNews Magazine 004.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftNews Weekly News #2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftoDown Bulk PAD Submitter 2.1.918.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softomate Multiple Search 1.2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftOrbits Digital Photo Suite 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftOrbits Html Web Gallery Generator 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softoria Capture 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftoTec BackItUp 1.6.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Christmas Wallpaper Pack 2004a.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Christmas Wallpaper Pack 2004b.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Drivers Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Gadget 0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Games Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Linux Software Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mac Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mobile Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Mobile ArchiveSOFTPEDIA SOFTWARE ARCHIVE.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia News 0.1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Search 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SOFTPEDIA SOFTWARE ARCHIVE.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 1.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 2.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 3.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Wallpaper Pack 4.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\Softpedia Webscripts Archive.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper 3GP Video Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD Ripper 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to 3GP Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to AVI Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to iPod Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to iPod Video Suite 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1
C:\Users\suser\AppData\Roaming\m1\shared\SoftPepper DVD to PSP Converter 1.0.zip Infected: Trojan-Downloader.Win32.Bagle.yd 1

The selected area was scanned.


########################################################################
########################################################################
########################################################################

[iglooo101]

Hi emeraldnzl,
found these suspicious files
at
C:\Users\suser\AppData\Local\Temp
and I googled:
here is what I found:
***Urban Dictionary: jkos1. jkos.
***Short for Just Keep On Smiling.
***Don't worry about it, jkos!
***by Eleanor Bagel Jul 29, 2005
I think they have a back door somewhere to download all files we have deleted

>>>full path empty folder:
C:\Users\suser\AppData\Local\Temp\hsperfdata_suser
>>>and this:
C:\Users\suser\AppData\Local\Temp\jkos-suser <<< not sure about whom this cluster belongs to!!! some say it is Kaspersky !!!
C:\Users\suser\AppData\Local\Temp\jkos-suser\binaries
C:\Users\suser\AppData\Local\Temp\jkos-suser\engine
C:\Users\suser\AppData\Local\Temp\jkos-suser\engine\backup
C:\Users\suser\AppData\Local\Temp\jkos-suser\engine\bases
C:\Users\suser\AppData\Local\Temp\jkos-suser\engine\data
C:\Users\suser\AppData\Local\Temp\jkos-suser\engine\data\Patches
very fishy>>>>>>> it has xml file in it
C:\Users\suser\AppData\Local\Temp\jkos-suser\packages
C:\Users\suser\AppData\Local\Temp\jkos-suser\temp
C:\Users\suser\AppData\Local\Temp\jkos-suser\temp\signedMailFiles
empty folder
C:\Users\suser\AppData\Local\Temp\KAV Updater update files <<Googled...it belongs to >>Kaspersky Lab Forum > Update always downloading files KAV 7.0.1.321a
===
edit to say:

I am doing MBAM scan

Edited by iglooo101, 16 August 2008 - 01:55 PM.

[emeraldnzl]

Hi iglooo101,

Stop doing scans by yourself. It is just confusing things.

Now

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Users\suser\AppData\Roaming\m1

Save this as CFScript.txt, in the same location as ComboFix.exe



Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at C:\ComboFix.txt which I will require in your next reply.

So when you come back please post

• ComboFix text
• and a new HijackThis log

[iglooo101]

Hi emeraldnzl ,
Thank you very much for your help
I formatted the HD and started everything from scratch...the vermins were unstoppable
I am directing my attention to the USB external HD which is 1000% infected
again emeraldnzl , that you very much

[Rorschach112]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.