Have I been hacked? How do I fix it?

Archived from groups: microsoft.public.win2000.security (More info?)

go find the 'hosts' file... normally in system32\drivers\etc folder. edit
it with text editor and take out everything except for the line:

127.0.0.1 localhost

save and reboot, or maybe not reboot, not sure but doesn't hurt. that
should clear up the redirections that prevent you from getting to web sites.

"Gina" <anonymous@discussions.microsoft.com> wrote in message
news:2d0801c470c9$3dd34590$a401280a@phx.gbl...
> My anti virus stopped working plus I could not go to any
> anti virus websites. I managed to get another anti virus
> installed which did clear the virus's BUT still problem.
> Still can not go to any anti virus websites. Do I have
> corrupted windows reg files? What do you think I should
> do?
> 2004-07-22, 10:54:59, An error occurred while scanning
> file "C:\Documents and Settings\Administrator\NTUSER.DAT":
> Access is denied.
> 2004-07-22, 10:54:59, An error occurred while scanning
> file "C:\Documents and
> Settings\Administrator\ntuser.dat.LOG": Access is denied.
> 2004-07-22, 10:55:42, An error occurred while scanning
> file "C:\Documents and Settings\Administrator\Local
> Settings\Application Data\Microsoft\Windows\UsrClass.dat":
> Access is denied.
> 2004-07-22, 10:55:42, An error occurred while scanning
> file "C:\Documents and Settings\Administrator\Local
> Settings\Application
> Data\Microsoft\Windows\UsrClass.dat.LOG": Access is denied.
> 2004-07-22, 10:55:48, An error occurred while scanning
> file "C:\Documents and Settings\Administrator\Local
> Settings\Temp\IPWreg.txt": Access is denied.
>
> 2004-07-22, 11:09:48, Could not set file for reading
> on "C:\RECYCLER\NPROTECT\NPROTECT.LOG": Access is denied.
> 2004-07-22, 11:09:48, An error was detected
> on "C:\System Volume Information\*.*": Access is denied.
> 2004-07-22, 11:11:56, An error occurred while scanning
> file "C:\WINNT\system32\Perflib_Perfdata_4f8.dat": Access
> is denied.
> 2004-07-22, 11:12:11, An error occurred while scanning
> file "C:\WINNT\system32\wrhabw.exe": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\default": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\default.LOG": Access is
> denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SAM": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SAM.LOG": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SECURITY": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SECURITY.LOG": Access is
> denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\software": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\software.LOG": Access is
> denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\system": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SYSTEM.ALT": Access is
> denied.
>
> Sorry for the long list, this is what the check came back
> with, as well as a list of the virus's that it deleted.
>
> Hope somebody can help fix my system.
> Thanks
> Gina

Archived from groups: microsoft.public.win2000.security (More info?)

you have a worm,
it's a beast to say the least.
its one of these buggers (WORM_BAGLE )

http://www.trendmicro.com/vinfo/virusencyclo/default5.a...

I tryied to clean two box's with thisa beast on it,
maybe you can clean it up.



"Gina" <anonymous@discussions.microsoft.com> wrote in message
news:2d0801c470c9$3dd34590$a401280a@phx.gbl...
> My anti virus stopped working plus I could not go to any
> anti virus websites. I managed to get another anti virus
> installed which did clear the virus's BUT still problem.
> Still can not go to any anti virus websites. Do I have
> corrupted windows reg files? What do you think I should
> do?
> 2004-07-22, 10:54:59, An error occurred while scanning
> file "C:\Documents and Settings\Administrator\NTUSER.DAT":
> Access is denied.
> 2004-07-22, 10:54:59, An error occurred while scanning
> file "C:\Documents and
> Settings\Administrator\ntuser.dat.LOG": Access is denied.
> 2004-07-22, 10:55:42, An error occurred while scanning
> file "C:\Documents and Settings\Administrator\Local
> Settings\Application Data\Microsoft\Windows\UsrClass.dat":
> Access is denied.
> 2004-07-22, 10:55:42, An error occurred while scanning
> file "C:\Documents and Settings\Administrator\Local
> Settings\Application
> Data\Microsoft\Windows\UsrClass.dat.LOG": Access is denied.
> 2004-07-22, 10:55:48, An error occurred while scanning
> file "C:\Documents and Settings\Administrator\Local
> Settings\Temp\IPWreg.txt": Access is denied.
>
> 2004-07-22, 11:09:48, Could not set file for reading
> on "C:\RECYCLER\NPROTECT\NPROTECT.LOG": Access is denied.
> 2004-07-22, 11:09:48, An error was detected
> on "C:\System Volume Information\*.*": Access is denied.
> 2004-07-22, 11:11:56, An error occurred while scanning
> file "C:\WINNT\system32\Perflib_Perfdata_4f8.dat": Access
> is denied.
> 2004-07-22, 11:12:11, An error occurred while scanning
> file "C:\WINNT\system32\wrhabw.exe": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\default": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\default.LOG": Access is
> denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SAM": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SAM.LOG": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SECURITY": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SECURITY.LOG": Access is
> denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\software": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\software.LOG": Access is
> denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\system": Access is denied.
> 2004-07-22, 11:12:13, An error occurred while scanning
> file "C:\WINNT\system32\config\SYSTEM.ALT": Access is
> denied.
>
> Sorry for the long list, this is what the check came back
> with, as well as a list of the virus's that it deleted.
>
> Hope somebody can help fix my system.
> Thanks
> Gina