Virus Scanning Results on Domain01
192.168.1.20
SERVER02
C:\RECYCLER\S-1-5-21-57989841-162531612-839522115-500\Dc2.rar\demo.scr Infection: W32/Klez.H@mm
C:\RECYCLER\S-1-5-21-57989841-162531612-839522115-500\Dc3.rar\picacu.exe Infection: W32/Klez.H@mm
C:\RECYCLER\S-1-5-21-57989841-162531612-839522115-500\Dc4.rar\snoopy.scr Infection: W32/Klez.H@mm
C:\RECYCLER\S-1-5-21-57989841-162531612-839522115-500\Dc5.rar\setup.bat Infection: W32/Klez.H@mm
192.168.1.32
USER10
C:\WINNT\ap216.0xe Infection: Backdoor.Apdor.d Action: Deleted.
C:\WINNT\SYSTEM32\ipcNL.0xe Infection: Worm.Win32.Muma.e Action: Deleted.
C:\WINNT\SYSTEM32\jhkolql.0ll Infection: Backdoor.Apdor.d Action: Deleted.
C:\WINNT\SYSTEM32\JHKOLQL.0XE Infection: Backdoor.Apdor.d Action: Deleted.
C:\WINNT\SYSTEM32\SCVHOST.0XE Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\WINNT\SYSTEM32\SVCHOS1.0XE Infection: Backdoor.Agobot.be Action: Deleted.
C:\WINNT\SYSTEM32\winhlpp32.0xe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\Documents and Settings\USER10\Local Settings\Temp\jhkolql.0ll Infection: Backdoor.Apdor.d Action: Deleted
192.168.1.31
USER08
C:\WINDOWS\SYSTEM32\WINS\DLLHOST.0XE Infection: Worm.Win32.Welchia
C:\Documents and Settings\USER08\Local Settings\Application Data\Identities\{2C7A8CD0-78FA-427F-BF86-AE333A20DC52}\Microsoft\Outlook Express\Deleted Items.dbx\big@boss.com big@boss.com, Re: Sample.eml Infection: I-Worm.Sobig.a
192.168.1.26
USER01
C:\WINNT\SYSTEM32\ipcNL.exe Infection: Worm.Win32.Muma.e Action: Deleted.
C:\WINNT\SYSTEM32\winhlpp32.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\WINNT\SYSTEM32\WINS\DLLHOST.000 Infection: Worm.Win32.Welchia Action: Deleted.
C:\WINNT\SYSTEM32\hoho\hoho.rar\expl0rer.exe Infection: Backdoor.mIRC-based
C:\WINNT\SYSTEM32\hoho\hoho.rar\numbers.exe Infection: Backdoor.Iroffer.1213.a
C:\WINNT\SYSTEM32\hoho\hoho.rar\Rar.exe Infection: Win32.Parite.b
C:\WINNT\SYSTEM32\hoho\hoho.rar\script1.ini Infection: Backdoor.IRC.Digarix
C:\WINNT\SYSTEM32\hoho\hoho.rar\xscan.exe Infection: HackTool.Win32.XScan.23
C:\WINNT\SYSTEM32\hoho\hoho.rar\dat\cgi.lst Infection: Exploit.IIS.WebDir
C:\Documents and Settings\SWEEPUPD.HLDOMAIN2\Templates\service.exe Infection: Backdoor.SdBot.gen Action: Deleted.
C:\Documents and Settings\SWEEPUPD.HLDOMAIN2\Templates\winspsv.exe Infection: Backdoor.SdBot.gen Action: Deleted.
C:\Documents and Settings\Default User\Templates\service.exe Infection: Backdoor.SdBot.gen Action: Deleted.
C:\Documents and Settings\Default User\Templates\winspsv.exe Infection: Backdoor.SdBot.gen Action: Deleted
192.168.1.14
Unknown
c:\WINDOWS\Application Data\Identities\{753C8860-4D1D-11D6-9130-F0864C9A5A26}\Microsoft\Outlook Express\Sent Items.dbx\, Unknown emails.eml Infection: I-Worm.Fizzer
192.168.1.29
USER06
C:\Program Files\Norton AntiVirus\Quarantine\4CF313CD.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\4CFA67C6.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\4D003BBF.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\4D0A39B4.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\4D1437A9.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\4D1A0BA2.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\56A06883 Infection: I-Worm.Swen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\56E55A38 Infection: I-Worm.Swen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\5DE95B38 Infection: I-Worm.Swen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\6602004E Infection: I-Worm.Swen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\6959530D Infection: I-Worm.Swen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\6FAC0198.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\73044511 Infection: I-Worm.Swen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\733F38D1 Infection: I-Worm.Swen Action: Deleted.
C:\Program Files\Norton AntiVirus\Quarantine\73983423 Infection: Worm.Win32.Welchia Action: Deleted
C:\80.exe Infection: Backdoor.Delf.il Action: Deleted.
C:\Q230903.exe Infection: TrojanDownloader.Win32.WinShow Action: Deleted
192.168.1.6
USER04
C:\WINDOWS\SYSTEM32\ipcNL.exe Infection: Worm.Win32.Muma.e Action: Deleted.
C:\WINDOWS\SYSTEM32\qjinfo.exe Infection: Worm.Win32.Muma.c Action: Deleted.
C:\WINDOWS\SYSTEM32\WINS\DLLHOST.EXE Infection: Worm.Win32.Welchia Action: Deleted.
C:\System Volume Information\_restore{3A3E5973-E5FA-459E-80C8-412146207F6C}\RP2\A0000228.exe Infection: Worm.Win32.Muma.e Action: Deleted.
C:\System Volume Information\_restore{3A3E5973-E5FA-459E-80C8-412146207F6C}\RP2\A0000229.exe Infection: Worm.Win32.Muma.c Action: Deleted.
C:\System Volume Information\_restore{3A3E5973-E5FA-459E-80C8-412146207F6C}\RP2\A0000230.EXE Infection: Worm.Win32.Welchia Action: Deleted.
192.168.1.17
Unknown
C:\WINDOWS\SYSTEM32\scvhost.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\WINDOWS\SYSTEM32\svchos1.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\WINDOWS\SYSTEM32\svchos1.exe.poly Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\WINDOWS\SYSTEM32\winhlpp32.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\WINDOWS\SYSTEM32\WINS\DLLHOST.EXE Infection: Worm.Win32.Welchia Action: Deleted.
C:\System Volume Information\_restore{A618A354-153A-42F7-974D-426ED4AA1C46}\RP2\A0000254.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\System Volume Information\_restore{A618A354-153A-42F7-974D-426ED4AA1C46}\RP2\A0000255.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\System Volume Information\_restore{A618A354-153A-42F7-974D-426ED4AA1C46}\RP2\A0000256.exe Infection: Backdoor.Agobot.3.gen Action: Deleted.
C:\System Volume Information\_restore{A618A354-153A-42F7-974D-426ED4AA1C46}\RP2\A0000257.EXE Infection: Worm.Win32.Welchia Action: