Re: MySpace confusion
That yahoo stuff is ok, its part of his SBC Yahoo Experience! He's where I am at the moment.
[quote]
Incident Status Location
[B] Adware[/B]:Adware/QoolShown [B]No disinfected[/B] C:\WINNT\SYSTEM32\KKDSKP.EXE
[B] Adware[/B]:adware/consumeralertsystem[B]No disinfected[/B] C:\Documents and Settings\Administrator\Local Settings\Temp\cassetup.exe
[B] Adware[/B]:adware/qoologic [B]No disinfected[/B] C:\WINNT\SYSTEM32\vgactl.cpl
[B] Spyware:[/B]spyware/surfsidekick [B]No disinfected[/B] C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Ssk.log
[B] Adware:[/B]adware/virtualbouncer [B]No disinfecte[/B]d C:\PROGRAM FILES\VBouncer
[B] Adware:[/B]adware/elitebar [B]No disinfected[/B] C:\WINNT\etb
[B] Spyware:[/B]spyware/clipgenie [B]No disinfected[/B] Windows Registry
[B] Virus:[/B]W32/Mimail.C.worm [B]Disinfected[/B] Archive Folders\Sent Items\FW: Re[2]: our private photos agaamrum\photos.zip[photos.jpg.exe]
[B] Adware:[/B]Adware/ISearch [B]No disinfected[/B] C:\Documents and Settings\Administrator\Local Settings\Temp\cmdinst.exe
[B] Spyware[/B]:Spyware/SurfSideKick [B]No disinfected[/B] C:\Documents and Settings\Administrator\Local Settings\Temp\i66D.tmp
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\Documents and Settings\Administrator\Local Settings\Temp\temp.fr217A
[B] Virus:[/B]W32/Bagle.AB.worm [B]Disinfected[/B] Personal Folders\Deleted Items\SpamTrap*SPAM* Fax Message Received\the_message.vbs
[B] Virus:[/B]W32/Mydoom.A.worm [B]Disinfected[/B] Personal Folders\Deleted Items\Server Report\test.zip[test.exe]
[B] Virus:[/B]W32/Mydoom.A.worm [B]Disinfected[/B] Personal Folders\Deleted Items\Hello\uvlplk.scr
[B] Virus:[/B]W32/Mydoom.A.worm [B]Disinfected[/B] Personal Folders\Deleted Items\vebpf\document.scr
[B] Virus:[/B]W32/Mydoom.A.worm [B]Disinfected[/B] Personal Folders\Deleted Items\Mail Delivery System\lnnyc.pif
[B] Virus[/B]:W32/Bagle.F.worm [B]Disinfected[/B] Personal Folders\Deleted Items^_^ meay-meay!\Picture.scr
[B] Virus:[/B]W32/Netsky.P.worm [B]Disinfected[/B] Personal Folders\Deleted Items\Mail Delivery (failure [EMAIL="snorton@npa412i.com%29%5Cmessage.scr"]snorton@npa412i.com)\message.scr[/EMAIL]
[B] Virus:[/B]W32/Netsky.P.worm [B]Disinfected[/B] Personal Folders\Deleted Items\Re: Mail Server\data.zip[details.txt .pif]
[B] Virus:[/B]W32/Bagle.U.worm [B]Disinfected[/B] Personal Folders\Deleted Items\atrrwkn.exe
[B]Virus:[/B]W32/Zafi.B.worm [B]Disinfected[/B] Personal Folders\Deleted Items\Check this out kid!!!\jennifer the wild girl xxx07.jpg.pif
[B] Virus:[/B]W32/Bagle.pwdzip [B]Disinfected[/B] Personal Folders\Inbox\Earthlink\RE: Protected message\Encrypted.zip
[B] Virus:[/B]W32/Bagle.pwdzip [B]Disinfected[/B] Personal Folders\Sent Items\FW: Protected message\Encrypted.zip
[B] Spyware:[/B]Spyware/SurfSideKick [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1080\A0092201.exe
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1082\A0092943.exe
[B] Spyware:[/B]Spyware/SurfSideKick [B]No disinfected [/B]C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1082\A0092945.dll
[B] Spyware:[/B]Spyware/SurfSideKick [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1082\A0092947.exe
[B] Adware:[/B]Adware/EliteBar [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1082\A0092948.dll [B]
Adware:[/B]Adware/QoolShown [B]No disinfected [/B]C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1082\A0092953.exe
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1082\A0092954.exe
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1082\A0092956.cpl
[B] Virus:[/B]Trj/Agent.AKT [B]Disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1082\A0093116.exe
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1083\A0093122.dll
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1083\A0093123.exe
[B] Virus:[/B]Trj/LdPinch.LD [B]Disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1083\A0093124.exe [B]
Virus:[/B]Trj/Qoologic.B [B]Disinfected [/B]C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1083\A0093125.dll
[B] Adware[/B]:Adware/QoolShown [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1084\A0094106.exe
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1084\A0094107.exe
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\System Volume Information_restore{B4353CB4-AAAB-4E18-9A0C-7AB27E1BB4D9}\RP1084\snapshot\MFEX-2.DAT
[B] Adware[/B]:Adware/Yahoo [B]No disinfected[/B] C:\WINNT\Downloaded Program Files\ycomp5_0_2_7.dll
[B] Adware:[/B]Adware/EliteBar [B]No disinfecte[/B]d C:\WINNT\etb\pokapoka76.exe
[B] Adware:[/B]Adware/Pacimedia [B]No disinfected[/B] C:\WINNT\system32\APD123.exe
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\WINNT\system32\ccqmcan.exe
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\WINNT\system32\dddsdsj.dll
[B] Virus:[/B]Trj/Qoologic.B [B]Disinfected[/B] C:\WINNT\system32\ddkad.dll
[B] Adware:[/B]Adware/ConsumerAlertSystem [B]No disinfected [/B]C:\WINNT\system32\dist001.exe
[B] Adware:[/B]Adware/Qoologic [B]No disinfected[/B] C:\WINNT\system32\ggkwg.dll
[B] Adware[/B]:Adware/QoolShown [B]No disinfected[/B] C:\WINNT\system32\kkdskp.exe
[B] Adware:[/B]Adware/Qoologic [B]No disinfected[/B] C:\WINNT\system32\kknokcr.dll
[B] Adware:[/B]Adware/ISearch [B]No disinfected[/B] C:\WINNT\system32\MTE2ODM6ODoxNg.exe
[B] Adware:[/B]Adware/QoolShown [B]No disinfected[/B] C:\WINNT\system32\qqykq.dat
[B] Adware:[/B]Adware/Pacimedia [B]No disinfected[/B] C:\WINNT\system32\sav2.exe
[B] Spyware:[/B]Spyware/SurfSideKick [B]No disinfected[/B] C:\WINNT\system32\SSK3_B5 Seedcorn 4.exe
Adware:Adware/Qoologic No disinfected C:\WINNT\system32\vgactl.cpl
Adware:Adware/QoolShown No disinfected C:\WINNT\system32\wuauclt.dll
[/quote]
:shock:
It was several worms, just as suspected. IE will no longer crash saying fatal error, it just opens and then closes again. If you can tolerate that log, you can see I disenfected all virus' however lots of adware/spyware remain - still getting popups. I will try to get Steve to show me the source message from myspace and post it.