[mark.w]

SpySweeper found the grand total of.... 0!


********
13:59: |··· Start of Session, 29 September 2005 ···|
13:59: Spy Sweeper started
13:59: Sweep initiated using definitions version 541
13:59: Starting Memory Sweep
14:02: Memory Sweep Complete, Elapsed Time: 00:02:29
14:02: Starting Registry Sweep
14:02: Registry Sweep Complete, Elapsed Time:00:00:08
14:02: Starting Cookie Sweep
14:02: Cookie Sweep Complete, Elapsed Time: 00:00:00
14:02: Starting File Sweep
14:02: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:02: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:02: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:02: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:02: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read from disk: Data error (cyclic redundancy check)
14:03: Warning: Failed to read MFT entry 3055
14:08: File Sweep Complete, Elapsed Time: 00:06:06
14:08: Full Sweep has completed. Elapsed time 00:08:47
14:08: Traces Found: 0
********

[Advertisements]

Let's try a couple things.

First run CleanUp to delete your temp files.

Flush your system restore, this will delete any restore points that you have but it will also make sure that any malware hiding in system restore will be booted off.

Turn off System Restore:

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Restart your computer, turn it back on and create a restore point.

Create a restore point:

• Click Start and point to All Programs.
• Mouse over Accessories, then System Tools, and select System Restore.
• In the System Restore wizard, select the box next the text labeled "Create a
  restore point" and click the Next button.
• Type a description for your new restore point. Something like "After
  cleanup". Click Create and you're done.

Now run a full scan with Norton and let me know what turns up.

[Buckeye_Sam]

Let's try a couple things.

First run CleanUp to delete your temp files.

Flush your system restore, this will delete any restore points that you have but it will also make sure that any malware hiding in system restore will be booted off.

Turn off System Restore:

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Restart your computer, turn it back on and create a restore point.

Create a restore point:

• Click Start and point to All Programs.
• Mouse over Accessories, then System Tools, and select System Restore.
• In the System Restore wizard, select the box next the text labeled "Create a
  restore point" and click the Next button.
• Type a description for your new restore point. Something like "After
  cleanup". Click Create and you're done.

Now run a full scan with Norton and let me know what turns up.

[mark.w]

Sam, when trying to create restore point:

Start -> Programs -> Access's -> System Tools, this only brings up 'Backup'. Will this do the same? I am running Win2000. ( Sorry for being a bit dumb again...)

Also, whilst I remember, within CleanUp, it doesn't allow me to check the 'Delete Prefetch Files' box - it's greyed out. Is this ok?

Man, I'm making life difficult for you aren't I...!

[Buckeye_Sam]

Not at all, that's my fault. Skip the whole part about System Restore and don't worry about Prefetch.

[mark.w]

Ok, well Norton seems to be pretty clear at the moment. Fingers crossed...

I am now away from the computer for a couple of days, so will try and see how it performs next week...

Thanks so much Sam. If I Paypal/donate, does it go direct to you?

[Buckeye_Sam]

Yes, a Paypal donation will go directly to me.
I'll keep your thread open for a while, so you can let me know if you run into any problems. In the meantime, here's some things you can do.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Managing Windows Millenium System Restore
  
  or
  
  Windows XP System Restore Guide
  
  Renable system restore with instructions from tutorial above
  
  
• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  
  A tutorial on installing & using this product can be found here:
  
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

[mark.w]

Sorry Sam, back again...

Came back to the computer after a few days away, and ran Norton AV in safe mode. The following were found and quarantined:

edit.bat (Trojan)
ntshare2.bat (Trojan)
remon.sys (HacKtool.rootkit)

Just prior to this, web pages were becoming either unviewable, or corrupted (red crosses for images, 'action cancelled' messages or pages coming up unformatted). Any ideas?!?

[Buckeye_Sam]

Go ahead and post a new hijackthis log and we'll take a look.

[mark.w]

Here we go... Thanks Sam.

Logfile of HijackThis v1.99.1
Scan saved at 10:05:10, on 05/10/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\javapanel.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\slserv.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINNT\soundman.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Office Mouse\moffice.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Office Mouse\MOUSE32A.EXE
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\BT Broadband\Help\bin\mpbtn.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Force9 Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Office Mouse\moffice.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BT Broadband Help.lnk = C:\Program Files\BT Broadband\Help\bin\matcli.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Shortcut to script.lnk = C:\script.bat
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://portal.f9.net.uk/
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager...unttracking.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6A368F4-F244-4176-B9E9-2684D73BED1C}: NameServer = 194.74.65.68 194.72.9.34
O20 - Winlogon Notify: PCANotify - C:\WINNT\SYSTEM32\PCANotify.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ECA (cpanel) - Unknown owner - C:\WINNT\javapanel.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Buckeye_Sam]

Everything looks ok there. Can you post the log from your last Norton scan?

[mark.w]

Sorry Sam... Other than these details, what else do I need to retrieve from Norton, and how do I go about doing it? Apologies if I'm being a bit slow...

[Buckeye_Sam]

There should be a log that you can pull up, but if you can't find that what I'm really looking for is the location of those files.

[mark.w]

Hi Sam - Sorry, been away again...

Norton is still quarantining the following:

Norton AntiVirus Quarantine Report
Created: 10 October 2005 13:40:43
------------------------------------------------------------------------------

File Name
Location
Status Size Virus Name
User Name Machine Name Domain
Date Quarantined
Date Submitted

------------------------------------------------------------------------------

remon.sys
C:\WINNT\system32
Quarantined 7.00 KB Hacktool.Rootkit
mark MARCOS MARCOS
10 October 2005 12:48:45
Not submitted

------------------------------------------------------------------------------

edit.BAT
C:\WINNT\system32\bside
Quarantined 888 bytes Trojan Horse
mark MARCOS MARCOS
04 October 2005 19:28:05
Not submitted

------------------------------------------------------------------------------

hpdriver.sys
C:\WINNT\system32
Quarantined 7.00 KB Hacktool.Rootkit
mark MARCOS MARCOS
29 August 2005 17:42:03
Not submitted

------------------------------------------------------------------------------

ntshare2.bat
C:\WINNT\system32\bside
Quarantined 221 bytes Trojan Horse
mark MARCOS MARCOS
04 October 2005 19:28:06
Not submitted

------------------------------------------------------------------------------

remon.sys
C:\WINNT\system32
Quarantined 7.00 KB Hacktool.Rootkit
mark MARCOS MARCOS
23 September 2005 13:58:53
Not submitted

------------------------------------------------------------------------------

remon.sys
C:\WINNT\system32
Quarantined 7.00 KB Hacktool.Rootkit
mark MARCOS MARCOS
07 October 2005 15:26:22
Not submitted

------------------------------------------------------------------------------

[Buckeye_Sam]

Ok, let's try a few things here.

First, go into Norton and get rid of those quarantined items.

Next, download Stinger to your desktop, but don't run it yet.
http://download.nai....t_i_n_g_e_r.exe



Please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.
• If you have trouble getting into Safe mode go here for more info.

Please go into the rdrivrem folder and double-click rdrivRem.bat to run the program - follow the instructions on the screen. After it's complete, rdriv.txt will be created in the rdrivRem folder.


Next, run Stinger. Let me know what it finds.


Finally let Norton do a full scan in Safe mode. Let me know if it finds anything also.



Reboot back to normal mode and let me know how it went.

[mark.w]

Thanks Sam.

rdriv.text is attached, and Stinger is pasted below. I deleted the quarantined items as recommended, and NortonAV found no infections when running in safe mode. Will see what happens as I use it...


McAfee AVERT Stinger Version 2.5.8 built on Oct 5 2005

Copyright © 2005 Networks Associates Technology, Inc. All Rights Reserved.

Virus data file v1000 created on Oct 5 2005.

Ready to scan for 54 viruses, trojans and variants.



Scan initiated on Mon Oct 10 14:26:58 2005

C:\WINNT\system32\2pac.txt

Found the W32/Sdbot.worm!ftp virus !!!

C:\WINNT\system32\2pac.txt has been deleted.

C:\WINNT\system32\i

Found the W32/Sdbot.worm!ftp virus !!!

C:\WINNT\system32\i has been deleted.

C:\WINNT\system32\o

Found the W32/Sdbot.worm!ftp virus !!!

C:\WINNT\system32\o has been deleted.

Number of clean files: 82521

Number of infected files: 3

Number of files deleted: 3

Attached Files

•  rdriv.txt   565bytes   100 downloads