Bagle (winupgrow) problem. Please help.

No! It runs on Vista too. It just does not support any 64 bit versions of Windows which many other tools do not support either. If we find any other stubborn entities in your logs that require forceful removal (and Bagle infections always do) you may have to use a bootable Vista x64 DVD to boot to the Recovery Console to manually delete files. Registry entries would still be a problem thoug and that may require restoring to a older restore point prior to the infection occurring. Do you have your bootable Vista x64 DVD?

You are the first person with a 64 bit version of Windows who has had a Bagle infection. I tend to doubt it could hook into x64 the way it does with 32 bit OS's.


Uninstall the below old software:
Java(TM) 6 Update 2
LiveReg (Symantec Corporation)
LiveUpdate 3.2 (Symantec Corporation)

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O3 - Toolbar: SYSTRAN Toolbar - {95daa571-4def-4a6d-97d8-98a346672a24} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [mule_st_key] C:\Users\Main\AppData\Roaming\m\flec006.exe
O4 - HKCU\..\Run: [drvsyskit] C:\Users\Main\AppData\Roaming\drivers\winupgro.exe
O4 - HKUS\S-1-5-18\..\Run: [SpybotSD TeaTimer] E:\Utilities\Spybot - Search & Destroy\TeaTimer.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [SpybotSD TeaTimer] E:\Utilities\Spybot - Search & Destroy\TeaTimer.exe (User 'Default user')
O8 - Extra context menu item: &Search - ?p=ZU

After clicking Fix, exit HJT.

Then attempt to delete the below files if they still exist:
C:\Windows\system32\CF11061.exe
C:\Windows\system32\CF12811.exe
C:\Windows\system32\CF13556.exe
C:\Windows\system32\xa246375.exe
C:\Windows\system32\xa247906.exe
C:\Windows\system32\xa784197234.exe
C:\Windows\system32\xa784199453.exe
C:\Windows\system32\xa785374375.exe
C:\Windows\system32\xa785375796.exe
C:\Windows\SysWOW64\CF11061.exe
C:\Windows\SysWOW64\CF12811.exe
C:\Windows\SysWOW64\CF13556.exe
C:\Windows\SysWOW64\cmd.execf
C:\Windows\SysWOW64\xa246375.exe
C:\Windows\SysWOW64\xa247906.exe
C:\Windows\SysWOW64\xa784197234.exe
C:\Windows\SysWOW64\xa784199453.exe
C:\Windows\SysWOW64\xa785374375.exe
C:\Windows\SysWOW64\xa785375796.exe
C:\Users\Main\AppData\Roaming\m\flec006.exe
C:\Users\Main\AppData\Roaming\drivers\winupgro.exe

Also delete below folder if it exists:
C:\Users\Main\AppData\Roaming\m

If any of the above would not delete, reboot into safe mode and try again.

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment


Also delete all files in the below folder except ones from the current date (Windows will not let you delete the files from the current day).
C:\Users\Main\AppData\Local\Temp

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below log:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You're welcome. Your logs are clean.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. Delete the ComboFix.exe file from your Desktop if you still have it there.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
6. Go to add/remove programs and uninstall HijackThis.
7. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
8. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!