Re: SCAN.EXE - McAfee AntiVirus Software
From: JohnNews (johncarryl_at_comcast.net)
Date: 01/16/04
- Next message: David H. Lipman: "Re: SCAN.EXE - McAfee AntiVirus Software"
- Previous message: taff: "Re: Trojan virus"
- In reply to: David H. Lipman: "Re: SCAN.EXE - McAfee AntiVirus Software"
- Next in thread: David H. Lipman: "Re: SCAN.EXE - McAfee AntiVirus Software"
- Reply: David H. Lipman: "Re: SCAN.EXE - McAfee AntiVirus Software"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 15 Jan 2004 22:06:55 -0500
David:
Thanks for investing so much of your time and for an excellent response to
the issue I raised. I am sure that you must enjoy what you do. I surely
do. I have learned a lot from your extensive insight on this subject.
A little over 1 year ago I discovered that a solid grasp of SCRIPTING can
significantly enhance the capabilities of any network Manager/Administrator.
Since then I have an obsession with scripting a wide range of networking
tasks.
Thanks,
John.
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:udovXg92DHA.1704@tk2msftngp13.phx.gbl...
> Replies are inline...
>
> Dave
>
>
> "JohnNews" <johncarryl@comcast.net> wrote in message
> news:ObuuIc82DHA.2060@TK2MSFTNGP10.phx.gbl...
> | Folks:
> |
> |
> | You will need to maximize your browser window to see the results of this
> | virus scan properly
> |
> | I have McAfee AntiVirus software (Version 6.02.3000.1) installed on my
Lap
> | Top. I have been experimenting with writing a DOS script to run and
> | generate an HTML report to be mailed to me at
> | 6:00 am so that I can read same on the train on my way to work. I am
> | investigating the possibility of running this script in parallel on a
bunch
> | of network computers and have only report summaries sent to be via
email.
>
>
> If this is a corporate LAN, you are using the wrong product. v6.x is a
retail product and
> you should be using v4.5.1 SP1 corporate or v7.1 Enterprise. What you
should be doing is
> having Alert Manager receive alerts and send selected personnel NetBIOS
pop-ups upon
> detection or certain errors. Alert Manager is a built in product in
Netshield (NT Server or
> Netware) or a separate product used with v7.1 enterprise. there is no
reason to receive a
> daily scan report for each PC. What is important is that events are
logged and support
> personnel are notified on a event.
>
>
> | The basic syntax of the script is SCAN.EXE /OPTION1 /OPTION2 /OPTION3
...
> | /OPTIONn
> |
> | Here are some of the issues that arise after studying the entire report:
> |
> | * I would love know if others have investigated a similar task or do
you
> | think this is all just a waste of time ?
>
>
> I do what you are doing all the time. not a waste. Only it is done for
remediation and
> rarely detection.
>
>
> | * How come I am using "Scan engine v4.2.60 for Win32", I thought I
had
> | McAfee AntiVirus software (Version 6.02.3000.1) installed on my machine
?
>
>
> There are three parts to McAfee: Kernel, ENGINE and DAT.
> The product you are using is the Kernel - Version 6.02.3000.1
> The ENGINE is v4260 (ENGINE v4320 was just released last week)
> The DAT is v4314
> You are using not the GUI but the McAfee Command Line Scanner. There are
three versions;
> SCAN.EXE, SCANPM.EXE and SCAN86.EXE. SCAN.EXE is a mixed DOS/Win32
program.
>
>
> | * The # of SWITCHES used in basic SCAN command is huge. Is there a
more
> | efficient choice to accomplish basically the same goals ?
>
> You don't need the following
> /RPTCOR
> /MAILBOX
> /RPTERR
> /CONTACTFILE SCANCONTACT1.TXT
> /REPORT SCANREPORT1.TXT you already are creating a HTML report, /HTML
HTMLREPORT1 I
> suggest redoing as.../HTML "HTMLREPORT1.HTML"
> Replace; /AD /ADN with /ADL
>
>
> | * How to solve these problems: "File could not be opened", "File is
> | password protected" ?
>
>
> You can't. You can't scan password protected files or files w/Open File
Handles.
>
>
> | * Is there a way to speed up running time of this script ?
>
>
> Remove extraneous switches otherwise, no you can't speed up the process
w/o a faster CPU.
>
>
> | * Feel free to raise any other issues that you think would be
> | relevant/beneficial to members of this newsgroup.
>
>
> I use the following command...
>
> SCAN.EXE /ADL /program /sub /mime /unzip /clean /del /html
"C:\ScanReport.HTML"
>
> |
> |
> | Thanks,
> | John.
> |
> |
> |
> | Virus Scan Report File
> |
>
| --------------------------------------------------------------------------
-- > | ---- > | Virus Scan Information > | -------------------------------------------------------------------------- -- > | ---- > | > | McAfee VirusScan for Win32 v4.26.0 > | Copyright (c) 1992-2003 Networks Associates Technology Inc. All rights > | reserved. > | (408) 988-3832 LICENSED COPY - May 16 2003 > | > | Scan engine v4.2.60 for Win32. > | Virus data file v4314 created Jan 14 2004 > | Scanning for 84549 viruses, trojans and variants. > | > | -------------------------------------------------------------------------- -- > | ---- > | Virus Scan Results > | -------------------------------------------------------------------------- -- > | ---- > | > | > | > | 01/15/2004 13:33:29 > | > | > | Options: > | /ALL /AD /ADN /ANALYZE /CLEAN /APPEND /UNZIP /SUB /MANALYZE /MIME /MAILBOX > | /PROGRAM /CONTACTFILE SCANCONTACT1.TXT /HTML HTMLREPORT1 /REPORT > | SCANREPORT1.TXT /RPTCOR /RPTERR > | > | Scanning C: [] > | Scanning C:\*.* > | C:\1 John Data Backup\Download Apps\isa presentation.exe\SETUP.MSI ... is > | corrupted. > | C:\1 John Data Backup\Download Apps\PMG -Toolkit2_4.exe\TOOLKIT.CAB ... is > | password-protected. > | C:\1 John Data Backup\Download Apps\PMG -Toolkit2_4.exe\SETUP.LST ... is > | password-protected. > | C:\1 John Data Backup\Download Apps\PMG -Toolkit2_4.exe\SETUP.EXE ... is > | password-protected. > | C:\1 John Data Backup\ISA 2000 Server Materials\isa > | presentation.exe\SETUP.MSI ... is corrupted. > | C:\1 John Data Backup\PMG Visio Stencil.zip\PMG DOCUNET STENCIL.VSS ... is > | password-protected. > | C:\1 John Data Backup\PMG whitepaper 1.zip\WP_PARADIGMS2002.PDF ... is > | password-protected. > | C:\1 John Data Backup\PMG whitepaper_response 2.zip\RESPONSE.PDF ... is > | password-protected. > | C:\1 John Data Backup\PMG_docunet sample-2003.zip\PMG_DOCUNET > | SAMPLE-2003.VSD ... is password-protected. > | C:\1 John Data Backup\Visual Basic Issues\Text Book - Hands On - VB6 For Web > | Development\WinZip\SETUP.WZ\WINZIP32.EX_ ... is password-protected. > | C:\1 John Data Backup\Visual Basic Issues\Text Book - Hands On - VB6 For Web > | Development\WinZip\winzip95.exe\SETUP.WZ\WINZIP32.EX_ ... is > | password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\AlexaRelated.zip\RELATED.HTM ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite1.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite10.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite11.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite12.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite13.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite14.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite15.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite16.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite17.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite18.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite19.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite2.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite20.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite21.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite22.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite23.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite24.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite25.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite26.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite27.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite28.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite29.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite3.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite30.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite31.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite32.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite33.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite34.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite35.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite36.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite37.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite38.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite39.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite4.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite40.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite41.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite42.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite43.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite44.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite45.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite46.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite47.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite48.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite49.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite5.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite50.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite51.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite52.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite53.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite54.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite55.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite56.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite57.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite58.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite59.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite6.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite60.zip\BACKWEB-8876480.EXE ... is > | password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite61.zip\BACKWEB-8876480.EXE ... is > | password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite7.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite8.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\BackWeblite9.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\DoubleClick.zip\JOHN@DOUBLECLICK[1].TXT ... is > | password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\DSOExploit.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\DSOExploit1.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\DSOExploit2.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\DSOExploit3.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\DSOExploit4.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\DSOExploit5.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\eBayToolbar.zip\EBAYTBAR.EXE ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\eBayToolbar1.zip\EBAYHTML.DLL ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\eBayToolbar2.zip\EBAYBAND.DLL ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\eBayToolbar3.zip\EBAYBAND.DLL ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\eBayToolbar4.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\eBayToolbar5.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\eBayToolbar6.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\eBayToolbar7.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\Gator.zip\GSTARTUP.LNK ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\Gator1.zip\SBRECOVERY.REG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\Gator2.zip\GATORPLUGIN.LOG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\Gator3.zip\DATE MANAGER WEBSITE.LNK ... is > | password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\Gator4.zip\PRECISIONTIME.LNK ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\Gator5.zip\ABOUT GAIN.LNK ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\Gator6.zip\GATORPDPSETUP.LOG ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\HitsLink.zip\JOHN@COUNTER.HITSLINK[1].TXT ... is > | password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\HitsLink1.zip\JOHN@COUNTER.HITSLINK[1].TXT ... is > | password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\HitsLink2.zip\JOHN@COUNTER.HITSLINK[2].TXT ... is > | password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\IPinsight.zip\IPINSIGT.DLL ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\VXf.zip\MSVIEW.DLL ... is password-protected. > | C:\Documents and Settings\All Users\Application Data\Spybot - Search & > | Destroy\Recovery\WhenUClockSync.zip\CLOCKSYNC.LNK ... is password-protected. > | C:\Documents and Settings\John\Local Settings\Application > | Data\Microsoft\Windows\UsrClass.dat ... file could not be opened. > | C:\Documents and Settings\John\Local Settings\Application > | Data\Microsoft\Windows\UsrClass.dat.LOG ... file could not be opened. > | C:\Documents and Settings\John\Local Settings\Temp\Perflib_Perfdata_d8.dat > | ... file could not be opened. > | C:\Documents and Settings\John\Local Settings\Temp\~DF5640.tmp ... file > | could not be opened. > | C:\Documents and Settings\John\Local Settings\Temp\~DF603F.tmp ... file > | could not be opened. > | C:\Documents and Settings\John\Local Settings\Temp\~DF6095.tmp ... file > | could not be opened. > | C:\Documents and Settings\John\Local Settings\Temp\~DF60FA.tmp ... file > | could not be opened. > | C:\Documents and Settings\John\Local Settings\Temp\~DFA980.tmp ... file > | could not be opened. > | C:\Documents and Settings\John\Local Settings\Temp\~DFB1D4.tmp ... file > | could not be opened. > | C:\Documents and Settings\John\Local Settings\Temp\~DFB203.tmp ... file > | could not be opened. > | C:\Documents and Settings\John\Local Settings\Temporary Internet > | Files\Content.IE5\61H0MV9A\wbk21C.tmp ... Found application > | Exploit-MIME.gen.c. > | The file has been deleted. > | C:\Documents and Settings\John\ntuser.dat ... file could not be opened. > | C:\Documents and Settings\John\ntuser.dat.LOG ... file could not be opened. > | C:\Documents and Settings\LocalService\Local Settings\Application > | Data\Microsoft\Windows\UsrClass.dat ... file could not be opened. > | C:\Documents and Settings\LocalService\Local Settings\Application > | Data\Microsoft\Windows\UsrClass.dat.LOG ... file could not be opened. > | C:\Documents and Settings\LocalService\ntuser.dat ... file could not be > | opened. > | C:\Documents and Settings\LocalService\ntuser.dat.LOG ... file could not be > | opened. > | C:\Documents and Settings\NetworkService\Local Settings\Application > | Data\Microsoft\Windows\UsrClass.dat ... file could not be opened. > | C:\Documents and Settings\NetworkService\Local Settings\Application > | Data\Microsoft\Windows\UsrClass.dat.LOG ... file could not be opened. > | C:\Documents and Settings\NetworkService\ntuser.dat ... file could not be > | opened. > | C:\Documents and Settings\NetworkService\ntuser.dat.LOG ... file could not > | be opened. > | C:\pagefile.sys ... file could not be opened. > | C:\Program Files\Microsoft SQL Server\data\MSSQL\Data\master.mdf ... file > | could not be opened. > | C:\Program Files\Microsoft SQL Server\data\MSSQL\Data\mastlog.ldf ... file > | could not be opened. > | C:\Program Files\Microsoft SQL Server\data\MSSQL\Data\model.mdf ... file > | could not be opened. > | C:\Program Files\Microsoft SQL Server\data\MSSQL\Data\modellog.ldf ... file > | could not be opened. > | C:\Program Files\Microsoft SQL Server\data\MSSQL\Data\msdbdata.mdf ... file > | could not be opened. > | C:\Program Files\Microsoft SQL Server\data\MSSQL\Data\msdblog.ldf ... file > | could not be opened. > | C:\Program Files\Microsoft SQL Server\data\MSSQL\Data\tempdb.mdf ... file > | could not be opened. > | C:\Program Files\Microsoft SQL Server\data\MSSQL\Data\templog.ldf ... file > | could not be opened. > | C:\psexec.exe\00012438.EXE ... Found application RemoteProcessLaunch. > | C:\Scripting - Landes\psexec.exe\00012438.EXE ... Found application > | RemoteProcessLaunch. > | C:\Scripting - Landes\psexec.zip\PSEXEC.EXE\00012438.EXE ... Found > | application RemoteProcessLaunch. > | File not renamed - could be archive or compound file. > | C:\Scripting - Landes\psTOOLS\psexec.exe\00012438.EXE ... Found application > | RemoteProcessLaunch. > | C:\Scripting - Landes\psTOOLS\pskill.exe ... Found application PSKill. > | The file has been renamed. > | C:\Scripting - Landes\Pstools.zip\PSKILL.EXE ... Found application PSKill. > | C:\Scripting - Landes\Pstools.zip\PSEXEC.EXE\00012438.EXE ... Found > | application RemoteProcessLaunch. > | C:\WINDOWS\$NtUninstallQ307274$\shgina.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ307274$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ307274$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ308131$\migrate.js ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ308131$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ308131$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ308402$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ308402$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ308402$\srrstr.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ308677$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ308677$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ308677$\userenv.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ309521$\dxmasf.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ309521$\lsasrv.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ309521$\msdxm.ocx ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ309521$\sfcfiles.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ309521$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ309521$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ310601$\mstask.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ310601$\mstinit.exe ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ310601$\schedsvc.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ310601$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ310601$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ310601$\srsvc.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ311345$\msobmain.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ311345$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ311345$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ311455$\shell32.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ311455$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ311455$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ311785$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ311785$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ311785$\w32time.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ311889$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ311889$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ311889$\termsrv.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ312368$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ312368$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ312368$\syssetup.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ312370$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ312370$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ312370$\usbhub.sys ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ312370$\usbport.sys ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ314412$\msgina.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ314412$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ314412$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ314862$\qmgr.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ314862$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ314862$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ315000$\netsetup.exe ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ315000$\spuninst\spuninst.exe ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ315000$\spuninst\spuninst.inf ... file could not be > | opened. > | C:\WINDOWS\$NtUninstallQ315000$\ssdpapi.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ315000$\ssdpsrv.dll ... file could not be opened. > | C:\WINDOWS\$NtUninstallQ315000$\upnp.dll ... file could not be opened. > | C:\WINDOWS\system32\config\default ... file could not be opened. > | C:\WINDOWS\system32\config\default.LOG ... file could not be opened. > | C:\WINDOWS\system32\config\SAM ... file could not be opened. > | C:\WINDOWS\system32\config\SAM.LOG ... file could not be opened. > | C:\WINDOWS\system32\config\SECURITY ... file could not be opened. > | C:\WINDOWS\system32\config\SECURITY.LOG ... file could not be opened. > | C:\WINDOWS\system32\config\software ... file could not be opened. > | C:\WINDOWS\system32\config\software.LOG ... file could not be opened. > | C:\WINDOWS\system32\config\system ... file could not be opened. > | C:\WINDOWS\system32\config\system.LOG ... file could not be opened. > | C:\WINDOWS\Temp\JET2672.tmp ... file could not be opened. > | C:\WINDOWS\Temp\Perflib_Perfdata_2a0.dat ... file could not be opened. > | C:\WINDOWS\Temp\Perflib_Perfdata_63c.dat ... file could not be opened. > | C:\WINDOWS\Temp\WebPoolFileFile ... file could not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\msoe.hlp ... file could not be > | opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\msoe50.inf ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\msoe.txt ... file could not be > | opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\aleabanr.gif ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\amaizrul.gif ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\anabnr2.gif ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\aswrule.gif ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\blank.htm ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\blankbkg.gif ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\btzhsepa.gif ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\citbanna.gif ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\citrbkg.gif ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\citrpun.htm ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\clearday.htm ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\clrdaybg.jpg ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\fieruld.gif ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\fiesta.htm ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\fiestabg.jpg ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\glacier.htm ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\glacrbkg.jpg ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\ivy.gif ... file could not be > | opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\ivy.htm ... file could not be > | opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\leaves.htm ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\leavesbg.jpg ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\maize.htm ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\maizebkg.jpg ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\nature.htm ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\naturebg.jpg ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\netblitz.htm ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\netblzbg.gif ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\piechtbg.jpg ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\piechts.htm ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\sunbanna.gif ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\sunfbkg.jpg ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\sunflowr.htm ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\sweets.htm ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\sweetsbg.gif ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\tech.gif ... file could not be > | opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\tech.htm ... file could not be > | opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\msoe.dll ... file could not be > | opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\oemig50.exe ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\oeimport.dll ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\setup50.exe ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\msimn.exe ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\inetcomm.dll ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\mapistub.dll ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\msoeres.dll ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\inetres.dll ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\csapi3t1.dll ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\oemiglib.dll ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\fixmapi.exe ... file could not > | be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\directdb.dll ... file could > | not be opened. > | C:\workssetup\MSWORKS\REDIST\IE6\TEMPFILE.CAB\9xmig.dll ... file could not > | be opened. > | > | Summary report on C:\*.* > | File(s) > | Total files: ........... 639680 > | Clean: ................. 639427 > | Possibly Infected: ..... 0 > | Cleaned: ............... 0 > | Deleted: ............... 1 > | Non-critical Error(s): 3 > | Master Boot Record(s): ......... 1 > | Possibly Infected: ..... 0 > | Boot Sector(s): ................ 1 > | Possibly Infected: ..... 0 > | > | > | Time: 02:25.46 > | > | > | -------------------------------------------------------------------------- -- > | ---- > | > | Visit the Network Associates Online Web Site > | Need some help or advice? Send email to Technical Support. > | > | > >
- Next message: David H. Lipman: "Re: SCAN.EXE - McAfee AntiVirus Software"
- Previous message: taff: "Re: Trojan virus"
- In reply to: David H. Lipman: "Re: SCAN.EXE - McAfee AntiVirus Software"
- Next in thread: David H. Lipman: "Re: SCAN.EXE - McAfee AntiVirus Software"
- Reply: David H. Lipman: "Re: SCAN.EXE - McAfee AntiVirus Software"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
