hallo leut, ich hab ma irgendwie den wuamgrd trojaner eingefangn, kann mir jemand helfen wie ich den runter bekomm?
ich hab da so n hijack gemacht der wie folgt aussieht..

Logfile of HijackThis v1.97.7
Scan saved at 16:17:07, on 21.06.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\CA\eTrust Antivirus\InoTask.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Dit.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\mHotkey.exe
C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\PRISMSTA.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\notepad32.exe
C:\WINDOWS\DitExp.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\WINDOWS\CNYHKey.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\arahopq.exe
C:\Dokumente und Einstellungen\gak1\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.medion.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Microsoft Update] wuamgrd.exe
O4 - HKLM\..\Run: [Windows Autostart Loader] notepad32.exe
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\arahopq.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe
O4 - HKLM\..\RunServices: [Windows Autostart Loader] notepad32.exe
O4 - HKLM\..\RunServices: [LAN Driver] landriver32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Microsoft Update] wuamgrd.exe
O4 - HKCU\..\Run: [Windows Autostart Loader] notepad32.exe
O4 - HKCU\..\RunServices: [Windows DLL host] "C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe"
O4 - Global Startup: Kontrollfeld für die kabellose Tastatur.lnk = C:\WINDOWS\CNYHKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...893.1583217593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAC82026-A5C5-4C55-B9D4-DE3892B12FA4}: NameServer = 195.3.96.67 195.3.96.68

Oh, das sieht nicht gut aus, zumal dahinter z.T. leistungsfähige Backdoors stecken, die anderen vollen Zugriff auf dein System ermöglichen. Aktiviere erstmal für deine DFÜ-Verbindung die XP Verbindungsfirewall. Weißt du, wie das geht?

Nachtrag: durch das Aktivieren dieser Verbindungsfirewall wird ausschließlich dem immer wieder neuen Schadsoftwarebefall durch diese Netzwerkwürmer entgegengewirkt. Schaden, der durch diese aktive Schadsoftware bereits verursacht wurde oder Zugriffe von außen über aktive Backdoors bleiben davon jedoch unberührt. Dein System befindet sich in undefiniertem Zustand, und sollte eigentlich nach Format c: neu aufgesetzt werden.

Ich kann dir zwar die einzelnen Schadsoftwaredateien nennen, die du im abgesicherten Modus von Windows entfernen könntest, doch wie gesagt, bereits zu deinem Nachteil erfolgte Änderungen am System können dadurch nicht rückgängig gemacht werden.

hallo, erstma danke dast gepostet hast,

weis net wirklich was du meinst,
grüss, stefan

Öffne über in >Start >Systemsteuerung den Bereich "Netzwerk und Internetverbindungen".

Klick mit rechts auf deine DFÜ-Verbindung und anschl. auf "Eigenschaften von (deiner DFÜ-Verbindung)".

Klick auf "Erweitert" und setze einen Haken bei:
"Internetverbindungsfirewall", bestätige abschließend mit OK.

ok danke vielmals, hab das gemacht,

also meinst das ich neu formatieren soll?
ich habe unter ausführen-msconfig mal die exe ausgeschalten, das hilft aba nix? hab leider auf dem gebiet nicht grad das beste wissen,

gruss stefan

Prüf diese fünf Dateien:

C:\WINDOWS\System32\notepad32.exe
C:\WINDOWS\System32\arahopq.exe
C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe
wuamgrd.exe
landriver32.exe

...bitte bei Kaspersky und poste hier die Ergebnisse. http://www.kaspersky.com/de/scanforvirus


In HijackThis markieren, Fix Checked wählen:

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL

O4 - HKLM\..\Run: [Microsoft Update] wuamgrd.exe
O4 - HKLM\..\Run: [Windows Autostart Loader] notepad32.exe
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\arahopq.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe
O4 - HKLM\..\RunServices: [Windows Autostart Loader] notepad32.exe
O4 - HKLM\..\RunServices: [LAN Driver] landriver32.exe
O4 - HKCU\..\Run: [Microsoft Update] wuamgrd.exe
O4 - HKCU\..\Run: [Windows Autostart Loader] notepad32.exe
O4 - HKCU\..\RunServices: [Windows DLL host] "C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe"

</font><blockquote>Zitat:</font><hr />Original erstellt von Falx:
ok danke vielmals, hab das gemacht,</font>[/QUOTE]OK, dann kommt jetzt wenigstens erstmal nichts mehr nach.

</font><blockquote>Zitat:</font><hr />also meinst das ich neu formatieren soll?</font>[/QUOTE]Wäre imho das sicherste, vor allem deine zukünftige Datensicherheit betreffend. Ohne die genauen Scanergebnisse zu kennen, vermute ich Backdoor.SDbot, Backdoor.Rbot und Backdoor.Agobot auf deinem System.

</font><blockquote>Zitat:</font><hr />ich habe unter ausführen-msconfig mal die exe ausgeschalten, das hilft aba nix?</font>[/QUOTE]Kaum, vor allem dann nicht, wenn noch immer aktive Backdoors sich wieder in die Registry schreiben. Da hilft am ehesten:

- Start des Systems im abgesicherten Modus.
- Beenden etaige laufender Backdoorprozesse über Strg + Alt + Entf, Prozess markieren, Prozess beenden.
- Löschen von Hand aller eben genannten Backdoordateien sowie der genannten Registry-Einträge mittels HijackThis.

hallo,
ich kann diese seite nicht öffnen, kaspersky.com

ok ich probier das mal mit hijackthis, meld mich danach wieder

</font><blockquote>Zitat:</font><hr />Original erstellt von Falx:
hallo,
ich kann diese seite nicht öffnen, kaspersky.com</font>[/QUOTE]Sorry, mein Fehler, ich habe nicht bedacht, dass bei aktivem Backdoor.Agobot die hosts-Datei manipuliert ist und somit ein Zugriff auf bestimmte AV-Seiten vom Backdoor unterbunden wird. Du kannst mir oder Rokop-Security diese Dateien auch zur Prüfung zusenden (E-Mail-Adressen siehe unten in meiner Signatur).

hallo hab nun mal das gemacht was du vorgeschlagen hast, mein HijackThis sieht nun wie folgt aus,

Logfile of HijackThis v1.97.7
Scan saved at 17:12:52, on 21.06.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\CA\eTrust Antivirus\InoTask.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Dit.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\mHotkey.exe
C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\PRISMSTA.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\WINDOWS\CNYHKey.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\DitExp.exe
C:\Programme\Internet Explorer\Iexplore.exe
C:\Dokumente und Einstellungen\gak1\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.medion.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\gehiyi.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Kontrollfeld für die kabellose Tastatur.lnk = C:\WINDOWS\CNYHKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...893.1583217593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

wie kann ich dir den die dateien schicken?
ich find sie nicht wenn ich sie suche, ich hab aber schon alle Dateien eingeblendet(auch versteckte)

gruss, Stefan

Den Eintrag noch fixen:
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\gehiyi.exe

Anstatt die nicht auffindbaren Dateien zu versenden , lass dieses Tool noch drüberlaufen:

http://www.trojaner-board.de/forum/u...c;f=6;t=005602

Wichtig: vorher die Signaturen updaten, wie beschrieben!

hallo markus, ich lass grad den scanner drüberlaufen, schon seit über 30 minuten, 40 viren entdeckt,muss jetzt aber raus ausn internet, ich post den log später wenn ich heimkomm oder morgn, also danke vielmals,bis morgn,

stefan

ok der scann is fertig, hab 140 files gefunden, davon ca 70 deleted, der rest renamed, soll ich die ganzen files raussuchen und hier posten?
ich hab noch immer das problem das mein internet richtig funktioniert, gibs noch irgendwelche tips?
thanks im voraus,
stefan

</font><blockquote>Zitat:</font><hr />Original erstellt von Falx:
ok der scann is fertig, hab 140 files gefunden, davon ca 70 deleted, der rest renamed, soll ich die ganzen files raussuchen und hier posten?</font>[/QUOTE]Ja, bitte aus dem Logfile die Infos zu den gelöschten und auch zu jenen, die nicht gelöscht werden konnten.

</font><blockquote>Zitat:</font><hr />ich hab noch immer das problem das mein internet richtig funktioniert, gibs noch irgendwelche tips?</font>[/QUOTE]Wenn die Auswertung der LogFiles nichts bringt: Neuafsetzen des Systems (was ich eh nahelegen würde. Grund: zu viel Schadsoftware).

Wichtig aber: dann VOR der ersten Internetverbindung Absicherungsmaßnahmen treffen. Wie gehst du ins Netz? DFÜ-Verbindung?

ok hier die files,

Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[11].exe
Mon Jun 21 17:52:50 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[11].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[12].exe
Mon Jun 21 17:52:50 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[12].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[13].exe
Mon Jun 21 17:52:50 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[13].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[14].exe
Mon Jun 21 17:52:50 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[14].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[15].exe
Mon Jun 21 17:52:50 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[15].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[16].exe
Mon Jun 21 17:52:50 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[16].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[17].exe
Mon Jun 21 17:52:50 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[17].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[18].exe
Mon Jun 21 17:52:50 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[18].exe infected by "Worm.Win32.Padobot.i" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[19].exe
Mon Jun 21 17:52:50 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[1].exe
Mon Jun 21 17:52:51 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[1].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:51 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[2].exe
Mon Jun 21 17:52:51 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[2].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:51 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[3].exe
Mon Jun 21 17:52:51 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[3].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:51 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[4].exe
Mon Jun 21 17:52:51 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[4].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:51 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[5].exe
Mon Jun 21 17:52:51 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[5].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:51 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[6].exe
Mon Jun 21 17:52:51 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[6].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:51 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[7].exe
Mon Jun 21 17:52:51 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[7].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:51 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[8].exe
Mon Jun 21 17:52:51 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[8].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:51 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[9].exe
Mon Jun 21 17:52:51 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[9].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:56 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\pb24[1].exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed.

Mon Jun 21 17:52:56 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[10].exe
Mon Jun 21 17:52:56 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[10].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:56 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[11].exe
Mon Jun 21 17:52:56 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[11].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:56 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[12].exe
Mon Jun 21 17:52:56 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[12].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:56 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[13].exe [**]
Mon Jun 21 17:52:56 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[9].exe
Mon Jun 21 17:52:56 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[9].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.

Mon Jun 21 17:52:56 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
Mon Jun 21 17:52:56 2004 =&gt; ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SYSTEM~1\LOKALE~1\TEMPOR~1\Content.IE5\index.dat
Mon Jun 21 17:52:56 2004 =&gt; Scanning Folder: C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ITONWRY5\*.*
Mon Jun 21 17:52:56 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ITONWRY5\desktop.ini
Mon Jun 21 17:52:56 2004 =&gt; Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ITONWRY5\pb22[1].exe
Mon Jun 21 17:53:01 2004 =&gt; File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ITONWRY5\pb22[1].exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed.
Mon Jun 21 17:55:22 2004 =&gt; File C:\WINDOWS\system32\wssvr.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed.
Mon Jun 21 17:55:23 2004 =&gt; File C:\WINDOWS\system32\wuamgrd.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed.
Mon Jun 21 17:55:30 2004 =&gt; File C:\34c.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed.
Mon Jun 21 17:57:45 2004 =&gt; File C:\Dokumente und Einstellungen\gak1\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CLEV8HQV\s-phx12[1].exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed.
Mon Jun 21 18:17:45 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005539.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken.
Mon Jun 21 18:17:47 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005566.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:17:47 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005567.exe
Mon Jun 21 18:17:47 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005567.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:17:47 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005568.exe
Mon Jun 21 18:17:48 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005568.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.
Mon Jun 21 18:17:50 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005590.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:17:50 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005596.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:17:51 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005608.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:17:52 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005611.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:17:56 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005784.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken.
Mon Jun 21 18:17:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005809.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:17:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005810.exe
Mon Jun 21 18:17:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005810.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:17:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005811.exe
Mon Jun 21 18:17:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005811.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.
Mon Jun 21 18:18:05 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005945.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken
Mon Jun 21 18:18:07 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005968.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:18:07 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005969.exe
Mon Jun 21 18:18:07 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005969.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:18:07 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005970.exe
Mon Jun 21 18:18:07 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005970.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action ken: File Deleted.
TaMon Jun 21 18:18:09 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005991.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken

Mon Jun 21 18:18:09 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005997.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:18:10 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0006011.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:18:11 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0006014.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:18:15 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006135.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken.
Mon Jun 21 18:18:18 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006172.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:18:18 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006173.exe
Mon Jun 21 18:18:18 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006173.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:18:18 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006174.exe
Mon Jun 21 18:18:18 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006174.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.
Mon Jun 21 18:18:30 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006524.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken.
Mon Jun 21 18:18:31 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006537.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:18:31 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006538.exe
Mon Jun 21 18:18:31 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006538.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:18:31 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006539.exe
Mon Jun 21 18:18:31 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006540.exe
Mon Jun 21 18:18:31 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006540.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.
Mon Jun 21 18:18:34 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006573.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:18:35 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006579.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:18:35 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006594.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:18:36 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006597.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:18:51 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007143.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:51 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007144.exe
Mon Jun 21 18:18:51 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007144.exe tagged as not-a-virus:RiskWare.Tool.HideWindows. No Action Taken.

Mon Jun 21 18:18:51 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007145.exe
Mon Jun 21 18:18:51 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007145.exe infected by "Trojan.Win32.VB.is" Virus. Action Taken: File Deleted.

Mon Jun 21 18:18:51 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007146.dll
Mon Jun 21 18:18:51 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007146.dll infected by "Exploit.CAN-2003-0533" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:51 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007147.exe
Mon Jun 21 18:18:52 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007147.exe infected by "Exploit.Win32.DameWare.f" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:52 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007148.exe
Mon Jun 21 18:18:52 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007148.exe infected by "Exploit.IIS.Ssl.02" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:52 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007149.dll
Mon Jun 21 18:18:52 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007149.dll infected by "Exploit.Win32.Locator.b" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:52 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007150.exe
Mon Jun 21 18:18:52 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007150.exe infected by "HackTool.Win32.Mydoomer.b" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:52 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007151.exe
Mon Jun 21 18:18:52 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007151.exe infected by "Exploit.Win32.Imail.c" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:52 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007152.exe
Mon Jun 21 18:18:53 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007152.exe infected by "Backdoor.PsyBot.a" Virus. Action Taken: File Renamed.
Mon Jun 21 18:18:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007199.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007200.exe
Mon Jun 21 18:18:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007200.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007201.exe
Mon Jun 21 18:18:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007201.exe tagged as not-a-virus:RiskWare.Tool.HideWindows. No Action Taken.

Mon Jun 21 18:18:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007202.exe
Mon Jun 21 18:18:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007202.exe infected by "Trojan.Win32.VB.is" Virus. Action Taken: File Deleted.

Mon Jun 21 18:18:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007203.dll
Mon Jun 21 18:18:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007203.dll infected by "Exploit.CAN-2003-0533" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007204.exe
Mon Jun 21 18:18:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007204.exe infected by "Exploit.Win32.DameWare.f" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007205.exe
Mon Jun 21 18:18:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007205.exe infected by "Exploit.IIS.Ssl.02" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007206.dll
Mon Jun 21 18:18:58 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007206.dll infected by "Exploit.Win32.Locator.b" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:58 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007207.exe
Mon Jun 21 18:18:59 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007207.exe infected by "HackTool.Win32.Mydoomer.b" Virus. Action Taken: File Renamed.

Mon Jun 21 18:18:59 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007208.exe
Mon Jun 21 18:18:59 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007208.exe infected by "Exploit.Win32.Imail.c" Virus. Action Taken: File Renamed.
Mon Jun 21 18:19:06 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007364.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken
Mon Jun 21 18:19:08 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007384.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:19:08 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007385.dll
Mon Jun 21 18:19:08 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007386.exe
Mon Jun 21 18:19:08 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007386.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:19:08 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007387.dll
Mon Jun 21 18:19:08 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007388.exe
Mon Jun 21 18:19:08 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007388.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.
Mon Jun 21 18:19:10 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007410.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:19:11 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007416.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:19:11 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007430.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:19:12 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007433.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:19:12 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007450.exe infected by "Worm.Win32.Padobot.gen" Virus. Action Taken: File Deleted.
Mon Jun 21 18:19:15 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007541.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken.
Mon Jun 21 18:19:18 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007568.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:19:18 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007569.exe
Mon Jun 21 18:19:18 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007569.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.

Mon Jun 21 18:19:18 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007570.exe
Mon Jun 21 18:19:18 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007570.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted.
Mon Jun 21 18:19:21 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007607.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:19:21 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007613.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:19:22 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007623.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:19:22 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007626.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken.
Mon Jun 21 18:19:22 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007627.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.
Mon Jun 21 18:19:29 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007679.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:29 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007680.exe
Mon Jun 21 18:19:29 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007680.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:29 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007681.exe
Mon Jun 21 18:19:29 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007681.exe tagged as not-a-virus:RiskWare.Tool.HideWindows. No Action Taken.

Mon Jun 21 18:19:29 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007682.exe
Mon Jun 21 18:19:29 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007682.exe infected by "Trojan.Win32.VB.is" Virus. Action Taken: File Deleted.

Mon Jun 21 18:19:29 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007683.dll
Mon Jun 21 18:19:29 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007683.dll infected by "Exploit.CAN-2003-0533" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:29 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007684.exe
Mon Jun 21 18:19:30 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007684.exe infected by "Exploit.Win32.DameWare.f" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:30 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007685.exe
Mon Jun 21 18:19:30 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007685.exe infected by "Exploit.IIS.Ssl.02" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:30 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007686.dll
Mon Jun 21 18:19:30 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007686.dll infected by "Exploit.Win32.Locator.b" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:30 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007687.exe
Mon Jun 21 18:19:30 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007687.exe infected by "HackTool.Win32.Mydoomer.b" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:30 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007688.exe
Mon Jun 21 18:19:30 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007688.exe infected by "Exploit.Win32.Imail.c" Virus. Action Taken: File Renamed.
Mon Jun 21 18:19:32 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007809.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.
Mon Jun 21 18:19:34 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP39\A0007860.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.
Mon Jun 21 18:19:35 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP40\A0007863.exe infected by "HackTool.Win32.Mydoomer.b" Virus. Action Taken: File Renamed.
Mon Jun 21 18:19:42 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP41\A0008068.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:42 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP41\A0008069.exe
Mon Jun 21 18:19:42 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP41\A0008069.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.
Mon Jun 21 18:19:42 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP41\A0008094.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:47 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011220.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed.
Mon Jun 21 18:19:48 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011249.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted.
Mon Jun 21 18:19:48 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011264.exe infected by "Worm.Win32.Padobot.i" Virus. Action Taken: File Deleted.
Mon Jun 21 18:19:49 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011295.exe infected by "Exploit.Win32.DameWare.f" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:49 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011296.exe
Mon Jun 21 18:19:49 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011296.exe infected by "Exploit.IIS.Ssl.02" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:49 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011297.exe
Mon Jun 21 18:19:49 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011297.exe infected by "Exploit.Win32.Imail.c" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:49 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011298.dll
Mon Jun 21 18:19:49 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011298.dll infected by "Exploit.Win32.Locator.b" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:49 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011299.exe
Mon Jun 21 18:19:49 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011299.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:49 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011300.dll
Mon Jun 21 18:19:50 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011300.dll infected by "Exploit.CAN-2003-0533" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:50 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011301.exe
Mon Jun 21 18:19:50 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011301.exe infected by "Trojan.Win32.VB.is" Virus. Action Taken: File Deleted.

Mon Jun 21 18:19:50 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011302.exe
Mon Jun 21 18:19:50 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011302.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:50 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011303.exe
Mon Jun 21 18:19:50 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011303.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:50 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011304.exe
Mon Jun 21 18:19:50 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011304.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:50 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011305.exe
Mon Jun 21 18:19:51 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011305.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed.

Mon Jun 21 18:19:51 2004 =&gt; Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011306.exe
Mon Jun 21 18:19:51 2004 =&gt; File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011306.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed.
Mon Jun 21 18:19:56 2004 =&gt; File C:\win2k3.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed.