Spybot Search & Destroy Screenshot

[slgrieb]

Yesterday I went out on a service call for a malware infected system. I started by installing Spybot and running a scan. After a few minutes I told the customer, "Mmm, I think this needs to go back to the office." I set it up to run a scan, went on another job and when I came back this is what I saw.




I apologize for the quality of the photo, but I was trying to get it quickly because I was convinced the system would crash or explode. Anyway, the number of Win32.Agent.cmn infections is 29329. And that isn't a typo. You can use your browser's zoom feature to check it out.

I clicked the fix button, then left again. When I returned, Spybot had locked up, but when I rescanned the system 100% of the Win32.Agent.cmn infections were gone, and the second scan (which took about 12 minutes) removed everything but the Win32.Agent.pz infections. ComboFix killed those. After I ran Eset's online scan (clean, BTW) I took it back home.