Re: not a valid Win32 application - warning. Can't run antivirus apps

> On the Tools menu in Windows Explorer, click Folder Options.
> Click the View tab.
> Under the Hidden files and folders heading select Show hidden files and
> folders.
> Uncheck the Hide protected operating system files (recommended) option
> Click ok.
> Can you see those files now? send me a copy of the MBAM log

C:\WINDOWS\system32\drivers\downld (Trojan.Agent) -> Quarantined and

C:\Documents and Settings\Owner\Application Data\m (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld1671.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld7296.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld8265.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld4656.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld4546.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld4578.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld0921.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld6953.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld8453.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld6687.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld0140.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld8250.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld6312.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld4687.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld5625.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld1265.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld7921.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld1171.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld4640.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld7359.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld2593.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld9375.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld2750.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld5250.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld5703.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld7609.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld636734.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld704218.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld712703.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld734921.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld741343.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld771890.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld777218.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld804890.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld871015.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld877390.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld880187.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld937937.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld020203.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld2484.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld625.exe (Trojan.Agent) ->

C:\WINDOWS\system32\drivers\downld5109.exe (Trojan.Agent) ->

C:\WINDOWS\system32\mdelk.exe (Trojan.Spammer) -> Quarantined and

C:\WINDOWS\system32\wintems.exe (Trojan.Spammer) -> Quarantined and

(Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\srosa.sys (Rootkit.Bagle) -> Quarantined

> Any exe that still does not work like HJT will have to be deleted and
> re-download. I need about 3 more hours to put some finishing touches my
> script to rid you of that rootkit and another 2 to update Remove-it.

> Are you still having problems? Is system restore on or off? Now you need =

> use a boot disk to manually remove the files.

> > Are you still having problems? Is system restore on or off? Now you nee=

> > use a boot disk to manually remove the files.
> System restore is on. I saw no restore points. I successfully created
> one.

> > > Are you still having problems? Is system restore on or off? Now you n=

> > > use a boot disk to manually remove the files.
> > System restore is on. I saw no restore points. I successfully created
> > one.
> Another thing: rthdcpl.exe is in my startup tab on msconfig, and I
> have Realtek High Definition Audio listed in Device Manager, so maybe
> this is normal. But the process uses 30,184K in Mem Usage in Task
> Manager.That seems like a lot.
> Also, the popups from DriveSentry caused by winfilse.exe trying to
> write are annoying. I'm not sure if there even *is* a winfilse on this
> machine, and the popups demand attention before anything else. I've
> had several during the writing of this post.