[climberguy]

My pc and external hard drive have been infected with the project 1 virus (and possibly something else as well).
It has disabled task manager in my computer. I have scanned the machine with Norton 360 which has failed to find the virus.

I've had a look to a few forums and the solution seems to vary with different cases, any ideas/solutions please?

Guy

[Advertisements]

Hi who calls it project 1 ?

Download OTL to your Desktop
Secondary link

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
  
  
• Select All Users
• Under the Custom Scan box paste this in
  
  netsvcs
  BASESERVICES
  %SYSTEMDRIVE%\*.exe
  /md5start
  services.*
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  winsock.*
  /md5stop
  CREATERESTOREPOINT
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

THEN

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan




On completion of the scan click save log, save it to your desktop and post in your next reply

[Essexboy]

Hi who calls it project 1 ?

Download OTL to your Desktop
Secondary link

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
  
  
• Select All Users
• Under the Custom Scan box paste this in
  
  netsvcs
  BASESERVICES
  %SYSTEMDRIVE%\*.exe
  /md5start
  services.*
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  winsock.*
  /md5stop
  CREATERESTOREPOINT
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

THEN

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan




On completion of the scan click save log, save it to your desktop and post in your next reply

[climberguy]

Here are the logs. Will those scans have run on my external drives or just the pc hard drive?

OTL logfile created on: 10/10/2012 3:01:28 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Guy\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 1.36 Gb Available Physical Memory | 72.83% Memory free
3.74 Gb Paging File | 3.24 Gb Available in Paging File | 86.43% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 104.72 Gb Total Space | 69.76 Gb Free Space | 66.62% Space Free | Partition Type: NTFS
Drive G: | 465.76 Gb Total Space | 209.31 Gb Free Space | 44.94% Space Free | Partition Type: NTFS
Drive S: | 1.55 Gb Total Space | 1.21 Gb Free Space | 77.86% Space Free | Partition Type: NTFS

Computer Name: SARAH | User Name: Guy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/10 14:58:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Guy\Desktop\OTL.exe
PRC - [2012/06/16 03:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\6.4.0.9\ccsvchst.exe
PRC - [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/20 05:17:48 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- c:\xampp\service.exe -- (XAMPP)
SRV - [2012/09/24 17:07:27 | 000,250,288 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/09/14 21:59:49 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/06/16 03:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton 360\Engine\6.4.0.9\ccSvcHst.exe -- (N360)
SRV - [2012/01/28 13:55:10 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/07/14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- c:\programdata\trusteer\rapport\store\exts\rapportms\39624\rapportiaso.sys -- (RapportIaso)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Guy\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012/10/05 12:18:49 | 000,097,440 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SMR311.SYS -- (SMR311)
DRV - [2012/10/05 12:11:28 | 001,601,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20121004.032\NAVEX15.SYS -- (NAVEX15)
DRV - [2012/10/05 12:11:28 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/10/05 12:11:28 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/10/05 12:11:28 | 000,092,704 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20121004.032\NAVENG.SYS -- (NAVENG)
DRV - [2012/10/05 11:47:08 | 000,141,944 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2012/10/04 16:21:26 | 000,386,720 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20121004.001\IDSvix86.sys -- (IDSVix86)
DRV - [2012/09/28 01:02:52 | 000,995,488 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20120928.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012/07/06 03:17:57 | 000,574,112 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\N360\0604000.009\srtsp.sys -- (SRTSP)
DRV - [2012/07/06 03:17:57 | 000,032,928 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\0604000.009\srtspx.sys -- (SRTSPX)
DRV - [2012/06/07 05:43:43 | 000,132,768 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\0604000.009\ccsetx86.sys -- (ccSet_N360)
DRV - [2012/05/22 02:37:12 | 000,924,320 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\N360\0604000.009\symefa.sys -- (SymEFA)
DRV - [2011/11/17 04:38:00 | 000,318,584 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\0604000.009\symnets.sys -- (SymNetS)
DRV - [2011/11/17 04:17:48 | 000,149,624 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\0604000.009\ironx86.sys -- (SymIRON)
DRV - [2011/08/16 07:51:40 | 000,340,088 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\N360\0604000.009\symds.sys -- (SymDS)
DRV - [2010/11/20 05:30:16 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 05:30:16 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 05:30:16 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 03:24:42 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 02:59:46 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 02:14:46 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 02:14:42 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/03/31 04:13:28 | 000,379,904 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B)
DRV - [2009/07/14 00:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009/07/13 23:02:53 | 000,048,128 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SiSGB6.sys -- (SiSGbeLH)
DRV - [2008/12/29 08:24:52 | 000,463,872 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SISGRKMD.sys -- (SiS6350)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec....&pvid=6.0.0.145

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec....&pvid=6.0.0.145

IE - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec....&pvid=6.0.0.145
IE - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E8 92 15 09 D9 54 CB 01 [binary data]
IE - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg....pr&d=2012-10-10 13:33:08&v=12.2.5.34&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "https://www.facebook...k.com/home.php"
FF - prefs.js..extensions.enabledAddons: [email protected]:5.0.2
FF - prefs.js..extensions.enabledAddons: [email protected]:4.1.3
FF - prefs.js..extensions.enabledItems: [email protected]:3.8.7
FF - prefs.js..extensions.enabledItems: [email protected]:4.7.7
FF - prefs.js..extensions.enabledItems: [email protected]:1.80.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFFPlgn\ [2012/10/05 11:47:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\ [2012/10/10 14:57:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/09/14 21:59:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/10 13:00:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/07/20 12:01:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/09/15 14:39:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Guy\AppData\Roaming\Mozilla\Extensions
[2012/09/19 11:34:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Guy\AppData\Roaming\Mozilla\Firefox\Profiles\mlhkgxhj.default\extensions
[2012/09/19 11:34:46 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\Guy\AppData\Roaming\Mozilla\Firefox\Profiles\mlhkgxhj.default\extensions\[email protected]
[2012/09/12 12:47:31 | 000,000,000 | ---D | M] (LastPass) -- C:\Users\Guy\AppData\Roaming\Mozilla\Firefox\Profiles\mlhkgxhj.default\extensions\[email protected]
[2012/09/12 13:14:34 | 000,371,729 | ---- | M] () (No name found) -- C:\Users\Guy\AppData\Roaming\Mozilla\Firefox\Profiles\mlhkgxhj.default\extensions\[email protected]
[2012/03/25 12:37:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/09/14 21:59:50 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/24 12:38:10 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/04/30 17:23:05 | 000,001,525 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/10/10 13:33:02 | 000,003,750 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/09/14 21:59:46 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/30 17:23:04 | 000,000,935 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/04/30 17:23:04 | 000,001,166 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/09/14 21:59:46 | 000,002,253 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2012/04/30 17:23:04 | 000,001,121 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage:

O1 HOSTS File: ([2012/10/10 13:11:43 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\6.4.0.9\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\6.4.0.9\ips\ipsbho.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\6.4.0.9\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT File not found
O4 - Startup: C:\Users\Guy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GmoteServer.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-21-1374413839-639971669-1428673965-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{18BC8BD7-E17F-4ED0-83A8-B0E2A5D32A69}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FAC61786-672E-44AA-BD42-1000E86E8025}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/10/10 14:58:44 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Guy\Desktop\OTL.exe
[2012/10/10 14:55:10 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/10/10 14:54:38 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Local\Avg2013
[2012/10/10 14:52:04 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012/10/10 13:33:29 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Roaming\TuneUp Software
[2012/10/10 13:14:17 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/10/10 13:14:17 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Local\temp
[2012/10/10 13:04:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012/10/10 13:04:25 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Local\MFAData
[2012/10/10 13:04:25 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012/10/10 13:03:53 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/10/10 13:03:53 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/10/10 13:03:53 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/10/10 13:02:56 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/10/10 13:02:39 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/10/05 12:52:22 | 000,924,320 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\symefa.sys
[2012/10/05 12:52:22 | 000,574,112 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\srtsp.sys
[2012/10/05 12:52:22 | 000,340,088 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\symds.sys
[2012/10/05 12:52:22 | 000,318,584 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\symnets.sys
[2012/10/05 12:52:22 | 000,032,928 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\srtspx.sys
[2012/10/05 12:52:21 | 000,149,624 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\ironx86.sys
[2012/10/05 12:52:21 | 000,132,768 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\ccsetx86.sys
[2012/10/05 12:51:40 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\N360\0604000.009
[2012/10/05 12:49:26 | 000,000,000 | ---D | C] -- C:\Windows\System32\N360_BACKUP
[2012/10/05 12:26:25 | 000,000,000 | -H-D | C] -- C:\Windows\PIF
[2012/10/05 12:19:03 | 000,000,000 | ---D | C] -- C:\ProgramData\SMR311
[2012/10/05 12:18:49 | 000,097,440 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SMR311.SYS
[2012/10/05 12:18:41 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Local\NPE
[2012/10/05 12:18:03 | 002,957,840 | ---- | C] (Symantec Corporation) -- C:\Users\Guy\Desktop\NPE.exe
[2012/10/05 11:47:09 | 000,141,944 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2012/10/05 11:47:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2012/10/05 11:47:08 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2012/10/05 11:45:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\N360
[2012/10/05 11:45:10 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
[2012/10/05 11:45:10 | 000,000,000 | ---D | C] -- C:\Program Files\Norton 360
[2012/10/05 11:45:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012/10/05 11:41:11 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2012/10/05 11:41:11 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2012/10/01 10:30:16 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OxpsConverter.exe
[2012/10/01 10:14:23 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012/10/01 10:14:19 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012/10/01 10:14:18 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/10/01 10:14:17 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012/10/01 10:14:17 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/10/01 10:14:15 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/10/01 10:14:15 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/10/01 10:14:11 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/09/12 12:49:18 | 000,400,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll
[2012/09/12 12:49:10 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\RNDISMP.sys
[2012/09/12 12:49:07 | 000,240,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2012/09/12 12:49:07 | 000,187,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\FWPKCLNT.SYS
[2012/09/12 12:49:04 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/09/12 12:48:25 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2012/09/12 12:48:08 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browcli.dll

========== Files - Modified Within 30 Days ==========

[2012/10/10 15:05:43 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/10 15:05:36 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012/10/10 15:05:36 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/10/10 15:04:45 | 000,013,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/10 15:04:45 | 000,013,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/10 14:58:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Guy\Desktop\OTL.exe
[2012/10/10 14:57:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/10/10 14:56:51 | 1507,725,312 | -HS- | M] () -- C:\hiberfil.sys
[2012/10/10 14:47:15 | 000,016,410 | ---- | M] () -- C:\Users\Guy\Documents\cc_20121010_144711.reg
[2012/10/10 14:46:51 | 000,009,166 | ---- | M] () -- C:\Users\Guy\Documents\cc_20121010_144647.reg
[2012/10/10 14:46:32 | 000,016,658 | ---- | M] () -- C:\Users\Guy\Documents\cc_20121010_144626.reg
[2012/10/10 14:46:03 | 000,283,036 | ---- | M] () -- C:\Users\Guy\Documents\cc_20121010_144553.reg
[2012/10/10 13:38:34 | 000,292,552 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/10/10 13:11:43 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/10/05 15:49:40 | 000,002,226 | ---- | M] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2012/10/05 15:49:11 | 001,299,925 | ---- | M] () -- C:\Windows\System32\drivers\N360\0604000.009\Cat.DB
[2012/10/05 12:52:27 | 000,009,103 | ---- | M] () -- C:\Windows\System32\drivers\N360\0604000.009\VT20121002.018
[2012/10/05 12:18:49 | 000,097,440 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SMR311.SYS
[2012/10/05 12:18:10 | 002,957,840 | ---- | M] (Symantec Corporation) -- C:\Users\Guy\Desktop\NPE.exe
[2012/10/05 11:49:29 | 000,628,460 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/10/05 11:49:29 | 000,110,612 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/10/05 11:47:09 | 000,007,468 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2012/10/05 11:47:08 | 000,141,944 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2012/10/05 11:47:08 | 000,000,806 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2012/09/26 11:52:07 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\N360\0604000.009\isolate.ini
[2012/09/14 21:59:53 | 000,001,995 | ---- | M] () -- C:\Users\Guy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/09/12 13:35:40 | 000,002,061 | ---- | M] () -- C:\Users\Guy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk

========== Files Created - No Company Name ==========

[2012/10/10 14:47:13 | 000,016,410 | ---- | C] () -- C:\Users\Guy\Documents\cc_20121010_144711.reg
[2012/10/10 14:46:49 | 000,009,166 | ---- | C] () -- C:\Users\Guy\Documents\cc_20121010_144647.reg
[2012/10/10 14:46:29 | 000,016,658 | ---- | C] () -- C:\Users\Guy\Documents\cc_20121010_144626.reg
[2012/10/10 14:45:59 | 000,283,036 | ---- | C] () -- C:\Users\Guy\Documents\cc_20121010_144553.reg
[2012/10/10 13:03:53 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/10/10 13:03:53 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/10/10 13:03:53 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/10/10 13:03:53 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/10/10 13:03:53 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/10/05 15:49:40 | 000,002,226 | ---- | C] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2012/10/05 15:48:01 | 001,299,925 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\Cat.DB
[2012/10/05 12:53:19 | 000,009,103 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\VT20121002.018
[2012/10/05 12:52:22 | 000,007,492 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symds.cat
[2012/10/05 12:52:22 | 000,007,458 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symnet.cat
[2012/10/05 12:52:22 | 000,007,434 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symefa.cat
[2012/10/05 12:52:22 | 000,007,398 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\srtspx.cat
[2012/10/05 12:52:22 | 000,003,435 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symefa.inf
[2012/10/05 12:52:22 | 000,002,852 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symds.inf
[2012/10/05 12:52:22 | 000,001,441 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symnet.inf
[2012/10/05 12:52:22 | 000,001,388 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\srtspx.inf
[2012/10/05 12:52:21 | 000,007,450 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\iron.cat
[2012/10/05 12:52:21 | 000,007,446 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\ccsetx86.cat
[2012/10/05 12:52:21 | 000,007,380 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\srtsp.cat
[2012/10/05 12:52:21 | 000,001,388 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\srtsp.inf
[2012/10/05 12:52:21 | 000,000,827 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\ccsetx86.inf
[2012/10/05 12:52:21 | 000,000,742 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\iron.inf
[2012/10/05 12:51:40 | 000,000,172 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\isolate.ini
[2012/10/05 11:47:09 | 000,007,468 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2012/10/05 11:47:09 | 000,000,806 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2012/04/30 14:11:36 | 000,001,233 | ---- | C] () -- C:\Windows\System32\rar.exe
[2012/01/27 12:56:00 | 000,000,000 | ---- | C] () -- C:\Windows\System32\link.sys
[2012/01/03 16:18:12 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

========== ZeroAccess Check ==========

[2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Custom Scans ==========

========== Base Services ==========
SRV - [2009/07/14 02:14:53 | 000,062,464 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\aelupsvc.dll -- (AeLookupSvc)
SRV - [2010/11/20 05:18:04 | 000,047,104 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appinfo.dll -- (Appinfo)
SRV - [2009/07/14 02:14:11 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\alg.exe -- (ALG)
SRV - [2010/11/20 05:21:00 | 000,585,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\qmgr.dll -- (BITS)
SRV - [2010/11/20 05:18:08 | 000,494,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\BFE.DLL -- (BFE)
SRV - [2011/11/17 06:29:50 | 000,022,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\lsass.exe -- (KeyIso)
SRV - [2009/07/14 02:15:19 | 000,271,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\es.dll -- (EventSystem)
SRV - [2012/07/04 22:14:34 | 000,102,912 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\browser.dll -- (Browser)
SRV - [2012/04/24 05:36:42 | 000,140,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\cryptsvc.dll -- (CryptSvc)
SRV - [2010/11/20 05:21:04 | 000,376,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\rpcss.dll -- (DcomLaunch)
SRV - [2010/11/20 05:18:32 | 000,254,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp)
SRV - [2011/03/03 06:38:01 | 000,132,608 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dnsrslvr.dll -- (Dnscache)
SRV - [2009/07/14 02:15:13 | 000,098,304 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\eapsvc.dll -- (EapHost)
SRV - [2009/07/14 02:15:24 | 000,049,152 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\hidserv.dll -- (hidserv)
SRV - [2009/07/14 02:15:33 | 000,300,544 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\ipnathlp.dll -- (SharedAccess)
SRV - [2010/11/20 05:19:24 | 000,350,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\IPSECSVC.DLL -- (PolicyAgent)
No service found with a name of MsMpSvc
No service found with a name of NisSrv
SRV - [2009/07/14 02:16:15 | 000,313,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\swprv.dll -- (swprv)
SRV - [2009/07/14 02:15:41 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\mmcss.dll -- (MMCSS)
SRV - [2009/07/14 02:16:03 | 000,280,576 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\netman.dll -- (Netman)
SRV - [2009/07/14 02:16:03 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\netprofm.dll -- (netprofm)
SRV - [2010/11/20 05:20:32 | 000,242,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\nlasvc.dll -- (NlaSvc)
SRV - [2009/07/14 02:16:11 | 000,019,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\nsisvc.dll -- (nsi)
SRV - [2011/05/24 11:44:59 | 000,293,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpnpmgr.dll -- (PlugPlay)
SRV - [2012/02/11 06:37:49 | 000,317,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\spoolsv.exe -- (Spooler)
SRV - [2011/11/17 06:29:50 | 000,022,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\lsass.exe -- (ProtectedStorage)
No service found with a name of EMDMgmt
SRV - [2009/07/14 02:16:12 | 000,090,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\rasauto.dll -- (RasAuto)
SRV - [2010/11/20 05:21:02 | 000,286,208 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\rasmans.dll -- (RasMan)
SRV - [2010/11/20 05:21:04 | 000,376,832 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\rpcss.dll -- (RpcSs)
SRV - [2009/07/14 02:16:13 | 000,021,504 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\seclogon.dll -- (seclogon)
SRV - [2011/11/17 06:29:50 | 000,022,528 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\lsass.exe -- (SamSs)
SRV - [2009/07/14 02:16:20 | 000,073,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wscsvc.dll -- (wscsvc)
SRV - [2010/11/20 05:21:28 | 000,168,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\srvsvc.dll -- (LanmanServer)
SRV - [2010/11/20 05:21:20 | 000,328,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\shsvcs.dll -- (ShellHWDetection)
No service found with a name of slsvc
SRV - [2010/11/20 05:21:06 | 000,750,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\schedsvc.dll -- (Schedule)
SRV - [2010/11/20 05:21:30 | 000,242,176 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\tapisrv.dll -- (TapiSrv)
SRV - [2009/07/14 02:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes)
SRV - [2012/05/01 05:44:12 | 000,164,352 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\profsvc.dll -- (ProfSvc)
SRV - [2010/11/20 05:17:52 | 001,025,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\VSSVC.exe -- (VSS)
SRV - [2010/11/20 05:18:06 | 000,473,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\audiosrv.dll -- (Audiosrv)
SRV - [2010/11/20 05:18:06 | 000,473,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\audiosrv.dll -- (AudioEndpointBuilder)
SRV - [2010/11/20 05:21:08 | 000,125,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sdrsvc.dll -- (SDRSVC)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2010/11/20 05:21:36 | 001,086,976 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wevtsvc.dll -- (eventlog)
SRV - [2010/11/20 05:19:42 | 000,566,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\MPSSVC.dll -- (MpsSvc)
SRV - [2010/11/20 05:21:36 | 000,463,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wiaservc.dll -- (StiSvc)
SRV - [2010/11/20 05:17:24 | 000,073,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\msiexec.exe -- (msiserver)
SRV - [2009/07/14 02:16:19 | 000,168,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wbem\WMIsvc.dll -- (Winmgmt)
SRV - [2012/06/02 23:19:17 | 001,933,848 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wuaueng.dll -- (wuauserv)
SRV - [2010/11/20 05:18:36 | 000,214,016 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\dot3svc.dll -- (dot3svc)
SRV - [2009/07/14 02:16:19 | 000,829,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wlansvc.dll -- (Wlansvc)
SRV - [2010/11/20 05:21:38 | 000,084,480 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\wkssvc.dll -- (LanmanWorkstation)

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 05:17:10 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\erdnt\cache\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe

< MD5 for: SERVICES >
[2009/06/10 22:39:37 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\System32\drivers\etc\services
[2009/06/10 22:39:37 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_045b589158ae90da\services

< MD5 for: SERVICES.EXE >
[2009/07/14 02:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\erdnt\cache\services.exe
[2009/07/14 02:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\System32\services.exe
[2009/07/14 02:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2009/07/14 03:03:06 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 -- C:\Windows\System32\en-US\services.exe.mui
[2009/07/14 03:03:06 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 -- C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_69d39d3a8748c332\services.exe.mui

< MD5 for: SERVICES.LNK >
[2009/07/14 05:41:45 | 000,001,288 | ---- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/14 05:41:45 | 000,001,288 | ---- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2009/06/10 22:26:14 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\System32\wbem\services.mof
[2009/06/10 22:26:14 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.mof

< MD5 for: SERVICES.MSC >
[2009/07/14 03:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\System32\en-US\services.msc
[2009/06/10 22:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\System32\services.msc
[2009/07/14 03:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/10 22:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc

< MD5 for: SERVICES.PTXML >
[2009/07/13 21:20:01 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\System32\wdi\perftrack\Services.ptxml
[2009/07/13 21:20:01 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\Services.ptxml

< MD5 for: SVCHOST.EXE >
[2009/07/14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\erdnt\cache\svchost.exe
[2009/07/14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\System32\svchost.exe
[2009/07/14 02:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 05:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\erdnt\cache\userinit.exe
[2010/11/20 05:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010/11/20 05:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 05:17:56 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\erdnt\cache\winlogon.exe
[2010/11/20 05:17:56 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010/11/20 05:17:56 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< MD5 for: WINSOCK.DLL >
[2009/07/13 22:41:34 | 000,002,864 | ---- | M] (Microsoft Corporation) MD5=68485C5EF0E2EFCEBF21BBB1042B823B -- C:\Windows\System32\WINSOCK.DLL
[2009/07/13 22:41:34 | 000,002,864 | ---- | M] (Microsoft Corporation) MD5=68485C5EF0E2EFCEBF21BBB1042B823B -- C:\Windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1.7600.16385_none_fde3cf3dd3e16d0d\WINSOCK.DLL
[2009/07/13 22:41:34 | 000,002,864 | ---- | M] (Microsoft Corporation) MD5=68485C5EF0E2EFCEBF21BBB1042B823B -- C:\Windows\winsxs\x86_microsoft-windows-ntvdm-system32_31bf3856ad364e35_6.1.7601.17514_none_0014e305d0cff0a7\WINSOCK.DLL

< End of report >


OTL Extras logfile created on: 10/10/2012 3:01:28 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Guy\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 1.36 Gb Available Physical Memory | 72.83% Memory free
3.74 Gb Paging File | 3.24 Gb Available in Paging File | 86.43% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 104.72 Gb Total Space | 69.76 Gb Free Space | 66.62% Space Free | Partition Type: NTFS
Drive G: | 465.76 Gb Total Space | 209.31 Gb Free Space | 44.94% Space Free | Partition Type: NTFS
Drive S: | 1.55 Gb Total Space | 1.21 Gb Free Space | 77.86% Space Free | Partition Type: NTFS

Computer Name: SARAH | User Name: Guy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1374413839-639971669-1428673965-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{076810BF-71AE-4235-8F7E-3AFB456DF219}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0BFAF9FD-DAB7-405B-BAB0-47F1BFF3DAD8}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{0D38E1D0-4001-440F-9ED3-B631E3BFAECE}" = rport=10243 | protocol=6 | dir=out | app=system |
"{25950AB8-FE45-4DA7-8713-2A6343E27C87}" = lport=139 | protocol=6 | dir=in | app=system |
"{2D77BCD5-4775-4B2D-90CA-DF9B1DE03E3B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4E14B1C4-83DF-48E6-9178-8728596D1230}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4EB2BB70-6667-48C7-8ED2-66002A0FD4CD}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5D243BDA-E1A5-4D69-B260-280BF2CA3ED0}" = rport=139 | protocol=6 | dir=out | app=system |
"{6BFB948D-B4CB-4A01-947D-F101D7CE4D7E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6DD5A52A-5721-4E6C-975B-FBE3234BA8C0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7780479C-8B2D-49CE-A22D-2451FC302E16}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7BC92A8C-586C-4A56-A4AF-2826A6982FD1}" = lport=2869 | protocol=6 | dir=in | app=system |
"{83726152-6FFE-4F98-A99B-32AFF9D82501}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8E410CFC-5FD6-470E-B854-8327AED0364D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{A053171D-E97A-4339-BE37-31E1C83B7D27}" = rport=137 | protocol=17 | dir=out | app=system |
"{A84C471D-BE9E-4706-B5A1-B6E3A8B14A65}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A9B9E5FF-3242-4B25-A2D4-0B1B29E21573}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A9E8F106-1D17-4C13-91A8-33494D88E737}" = rport=138 | protocol=17 | dir=out | app=system |
"{AF9DE211-E264-49A9-B035-8AADD37E0642}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B0FC5AE7-0C57-4BAD-AA91-CA05E19A7053}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{C14CB917-BF0C-44CA-B7D9-5C22E6A1CA84}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C2A25F25-B5FF-45F5-A42D-24A47BEF7832}" = lport=137 | protocol=17 | dir=in | app=system |
"{CD1E258E-B5E3-4150-BE25-96111A026AAC}" = lport=445 | protocol=6 | dir=in | app=system |
"{D882125C-06FC-418D-A1ED-540F6EEC9F9E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DA0712D4-14A1-4F1B-BD69-5117841C9C7F}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{DA496C3B-03DB-445F-91A9-4AB4F021F2FD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E2986350-0A73-4FDA-A3E7-7B3ED878190D}" = lport=138 | protocol=17 | dir=in | app=system |
"{EFAF5FDE-85FC-4D46-84A1-5518C5C7294C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{EFDE245B-2372-4B73-A313-9DD2F8794342}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{FDA1FC07-4E66-4639-97CF-530021D33571}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FFE00681-D4FC-4646-831A-A61A7A408349}" = rport=445 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01B81EBB-2D5F-47CF-99DB-1C52B101FDB0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{06EFE9BE-F67F-45FF-8543-E1A328B15380}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{1330A3F5-4853-459C-ACA2-1C7BF8D8B7AF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{14AF3353-77D4-4F76-934D-C6E263C3C5F8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1F20DB10-F7BB-4212-8C60-EA53F5C21738}" = protocol=1 | dir=in | [email protected],-28543 |
"{2099ABCB-0286-407D-B6B4-FA4DBEF8A3A1}" = protocol=58 | dir=in | [email protected],-28545 |
"{2730AA57-C2F0-4CCA-B5AC-E3FB376157CF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{31A49FAD-E145-4D4E-8470-61ACFDFBDD6C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{406C6E0E-4CF9-4C43-8FC7-9E698939735D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{45307CFC-28FB-4DA6-9F67-7FFB5AEA16A6}" = protocol=6 | dir=out | app=system |
"{5B763FBD-C26B-4992-8671-95053A4D3CE8}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{5F92B870-7363-4AE0-84C0-F7F651B7D87B}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{6222B67C-B5D9-445B-B5D3-49D2D22BB3DE}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{687C07C0-5A64-41F0-B86B-3FF6312272A4}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{75C87D0C-BE86-48C4-AD48-BFBBA84B273F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{A097ADC5-972C-4EA0-86E5-76E4E005955C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A32E1A92-754E-44EC-B3A6-B27D008CB0C4}" = protocol=58 | dir=out | [email protected],-28546 |
"{AF3D8C38-D7F6-4F46-B77F-30CAD5846C2C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B56E1979-3F3E-47DC-B18D-E592CC355E16}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B8AE26CA-BE6A-471B-9555-0D0354DA7CBF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BDEA0EB5-122F-4A79-92B4-247194D51F93}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{DF35019B-9C05-4BF1-BC20-6B17B8E92D15}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{DF62FD9E-2E9D-4376-80EC-3364369465B6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{F3AC9649-4F95-4D77-A08B-911B3D6EF5A8}" = protocol=1 | dir=out | [email protected],-28544 |
"{F9392A2E-D18A-40C4-ACE5-78CD64FFC0EE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{13D766DD-FCEB-4FCC-953D-982DE136FDF1}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{C845A3FC-D119-446A-80BF-227436FCD096}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{8B9486B3-6B0C-4D01-AF6E-040F6A7C1498}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{99B7C38A-1B2F-407E-8B9D-CEC53C242321}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 15.0.1 (x86 en-GB)" = Mozilla Firefox 15.0.1 (x86 en-GB)
"Mozilla Thunderbird 15.0.1 (x86 en-GB)" = Mozilla Thunderbird 15.0.1 (x86 en-GB)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"N360" = Norton 360

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 10/10/2012 9:54:42 AM | Computer Name = Sarah | Source = System Restore | ID = 8193
Description =

Error - 10/10/2012 9:57:32 AM | Computer Name = Sarah | Source = Windows Search Service | ID = 9000
Description =

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Windows Search Service | ID = 7040
Description =

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Windows Search Service | ID = 9002
Description =

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Windows Search Service | ID = 3029
Description =

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Windows Search Service | ID = 3029
Description =

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Windows Search Service | ID = 3028
Description =

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Windows Search Service | ID = 3058
Description =

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Windows Search Service | ID = 7010
Description =

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Windows Search Service | ID = 7042
Description =

[ System Events ]
Error - 10/10/2012 8:49:10 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 10/10/2012 8:49:11 AM | Computer Name = Sarah | Source = DCOM | ID = 10005
Description =

Error - 10/10/2012 8:49:11 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 10/10/2012 8:49:11 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 10/10/2012 9:50:46 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 10/10/2012 9:53:43 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1068

Error - 10/10/2012 9:57:19 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7000
Description = The XAMPP Service service failed to start due to the following error:
%%2

Error - 10/10/2012 9:57:27 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
BHDrvx86

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7024
Description = The Windows Search service terminated with service-specific error
%%-1073473535.

Error - 10/10/2012 9:57:33 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7031
Description = The Windows Search service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 30000 milliseconds:
Restart the service.


< End of report >


aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-10-10 15:17:18
-----------------------------
15:17:18.322 OS Version: Windows 6.1.7601 Service Pack 1
15:17:18.322 Number of processors: 2 586 0xF0D
15:17:18.322 ComputerName: SARAH UserName: Guy
15:17:19.275 Initialize success
15:17:28.244 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
15:17:28.259 Disk 0 Vendor: Hitachi_HTS541612J9SA00 SBDOC7KP Size: 114473MB BusType: 3
15:17:28.291 Disk 0 MBR read successfully
15:17:28.291 Disk 0 MBR scan
15:17:28.306 Disk 0 Windows 7 default MBR code
15:17:28.322 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 5655 MB offset 2048
15:17:28.337 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 1587 MB offset 11583488
15:17:28.369 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 107229 MB offset 14833664
15:17:28.369 Disk 0 scanning sectors +234438656
15:17:28.447 Disk 0 scanning C:\Windows\system32\drivers
15:17:37.212 Service scanning
15:18:06.462 Modules scanning
15:18:40.212 Disk 0 trace - called modules:
15:18:40.275 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
15:18:40.291 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8579a648]
15:18:40.306 3 CLASSPNP.SYS[889be59e] -> nt!IofCallDriver -> [0x856b98a8]
15:18:40.322 5 ACPI.sys[884ab3d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0x856ac030]
15:18:40.337 Scan finished successfully
15:19:12.712 Disk 0 MBR has been saved successfully to "C:\Users\Guy\Desktop\MBR.dat"
15:19:12.712 The log file has been saved successfully to "C:\Users\Guy\Desktop\aswMBR.txt"

[Essexboy]

They will have just checked the main system drive

What is reporting this infect and what file is referenced ? As the last instance of this I can find is 2006


Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

:OTL
SRV - File not found [Auto | Stopped] -- c:\xampp\service.exe -- (XAMPP)
O4 - Startup: C:\Users\Guy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GmoteServer.lnk = File not found

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[climberguy]

Hi again,

Logs are below. Interesting you say that you find no instance of the infection after 2006. The machine was bought new at the end December 2007.
I found it running in the active processes and wanted to know what it was. It is replicating files and renamed folders as .exe applications. I beleive that the infection came from a usb drive that I had used overseas on a public machine.
I would like to know how to scan and clean my external drives as well, as do not wish to infect another machine.



OTL logfile created on: 10/10/2012 4:27:04 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Guy\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 1.38 Gb Available Physical Memory | 73.88% Memory free
3.74 Gb Paging File | 3.28 Gb Available in Paging File | 87.54% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 104.72 Gb Total Space | 68.82 Gb Free Space | 65.72% Space Free | Partition Type: NTFS
Drive G: | 465.76 Gb Total Space | 209.31 Gb Free Space | 44.94% Space Free | Partition Type: NTFS
Drive S: | 1.55 Gb Total Space | 1.21 Gb Free Space | 77.86% Space Free | Partition Type: NTFS

Computer Name: SARAH | User Name: Guy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/10 14:58:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Guy\Desktop\OTL.exe
PRC - [2012/06/16 03:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\6.4.0.9\ccsvchst.exe
PRC - [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/20 05:17:48 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV - [2012/10/10 16:05:24 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/09/14 21:59:49 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/06/16 03:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton 360\Engine\6.4.0.9\ccSvcHst.exe -- (N360)
SRV - [2012/01/28 13:55:10 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/07/14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- c:\programdata\trusteer\rapport\store\exts\rapportms\39624\rapportiaso.sys -- (RapportIaso)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Guy\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012/10/05 12:18:49 | 000,097,440 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SMR311.SYS -- (SMR311)
DRV - [2012/10/05 12:11:28 | 001,601,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20121004.032\NAVEX15.SYS -- (NAVEX15)
DRV - [2012/10/05 12:11:28 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/10/05 12:11:28 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/10/05 12:11:28 | 000,092,704 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20121004.032\NAVENG.SYS -- (NAVENG)
DRV - [2012/10/05 11:47:08 | 000,141,944 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2012/10/04 16:21:26 | 000,386,720 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20121004.001\IDSvix86.sys -- (IDSVix86)
DRV - [2012/09/28 01:02:52 | 000,995,488 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20120928.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012/07/06 03:17:57 | 000,574,112 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\N360\0604000.009\srtsp.sys -- (SRTSP)
DRV - [2012/07/06 03:17:57 | 000,032,928 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\0604000.009\srtspx.sys -- (SRTSPX)
DRV - [2012/06/07 05:43:43 | 000,132,768 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\0604000.009\ccsetx86.sys -- (ccSet_N360)
DRV - [2012/05/22 02:37:12 | 000,924,320 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\N360\0604000.009\symefa.sys -- (SymEFA)
DRV - [2011/11/17 04:38:00 | 000,318,584 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\0604000.009\symnets.sys -- (SymNetS)
DRV - [2011/11/17 04:17:48 | 000,149,624 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\0604000.009\ironx86.sys -- (SymIRON)
DRV - [2011/08/16 07:51:40 | 000,340,088 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\N360\0604000.009\symds.sys -- (SymDS)
DRV - [2010/11/20 05:30:16 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 05:30:16 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 05:30:16 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 03:24:42 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 02:59:46 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 02:14:46 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 02:14:42 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/03/31 04:13:28 | 000,379,904 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B)
DRV - [2009/07/14 00:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009/07/13 23:02:53 | 000,048,128 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SiSGB6.sys -- (SiSGbeLH)
DRV - [2008/12/29 08:24:52 | 000,463,872 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SISGRKMD.sys -- (SiS6350)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec....&pvid=6.0.0.145
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E8 92 15 09 D9 54 CB 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg....pr&d=2012-10-10 13:33:08&v=12.2.5.34&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "https://www.facebook...k.com/home.php"
FF - prefs.js..extensions.enabledAddons: [email protected]:5.0.2
FF - prefs.js..extensions.enabledAddons: [email protected]:4.1.3
FF - prefs.js..extensions.enabledItems: [email protected]:3.8.7
FF - prefs.js..extensions.enabledItems: [email protected]:4.7.7
FF - prefs.js..extensions.enabledItems: [email protected]:1.80.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFFPlgn\ [2012/10/05 11:47:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\ [2012/10/10 16:25:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/09/14 21:59:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/10 13:00:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/07/20 12:01:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/09/15 14:39:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Guy\AppData\Roaming\Mozilla\Extensions
[2012/09/19 11:34:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Guy\AppData\Roaming\Mozilla\Firefox\Profiles\mlhkgxhj.default\extensions
[2012/09/19 11:34:46 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\Guy\AppData\Roaming\Mozilla\Firefox\Profiles\mlhkgxhj.default\extensions\[email protected]
[2012/09/12 12:47:31 | 000,000,000 | ---D | M] (LastPass) -- C:\Users\Guy\AppData\Roaming\Mozilla\Firefox\Profiles\mlhkgxhj.default\extensions\[email protected]
[2012/09/12 13:14:34 | 000,371,729 | ---- | M] () (No name found) -- C:\Users\Guy\AppData\Roaming\Mozilla\Firefox\Profiles\mlhkgxhj.default\extensions\[email protected]
[2012/03/25 12:37:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/09/14 21:59:50 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/24 12:38:10 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/04/30 17:23:05 | 000,001,525 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/10/10 13:33:02 | 000,003,750 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/09/14 21:59:46 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/30 17:23:04 | 000,000,935 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/04/30 17:23:04 | 000,001,166 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/09/14 21:59:46 | 000,002,253 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2012/04/30 17:23:04 | 000,001,121 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage:

O1 HOSTS File: ([2012/10/10 16:23:01 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\6.4.0.9\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\6.4.0.9\ips\ipsbho.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\6.4.0.9\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{18BC8BD7-E17F-4ED0-83A8-B0E2A5D32A69}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FAC61786-672E-44AA-BD42-1000E86E8025}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/10/10 16:22:59 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/10/10 15:16:59 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Guy\Desktop\aswMBR.exe
[2012/10/10 14:58:44 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Guy\Desktop\OTL.exe
[2012/10/10 14:55:10 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/10/10 14:54:38 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Local\Avg2013
[2012/10/10 14:52:04 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012/10/10 13:33:29 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Roaming\TuneUp Software
[2012/10/10 13:14:17 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/10/10 13:14:17 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Local\temp
[2012/10/10 13:04:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012/10/10 13:04:25 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Local\MFAData
[2012/10/10 13:04:25 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012/10/10 13:03:53 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/10/10 13:03:53 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/10/10 13:03:53 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/10/10 13:02:56 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/10/10 13:02:39 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/10/05 12:52:22 | 000,924,320 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\symefa.sys
[2012/10/05 12:52:22 | 000,574,112 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\srtsp.sys
[2012/10/05 12:52:22 | 000,340,088 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\symds.sys
[2012/10/05 12:52:22 | 000,318,584 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\symnets.sys
[2012/10/05 12:52:22 | 000,032,928 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\srtspx.sys
[2012/10/05 12:52:21 | 000,149,624 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\ironx86.sys
[2012/10/05 12:52:21 | 000,132,768 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0604000.009\ccsetx86.sys
[2012/10/05 12:51:40 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\N360\0604000.009
[2012/10/05 12:49:26 | 000,000,000 | ---D | C] -- C:\Windows\System32\N360_BACKUP
[2012/10/05 12:26:25 | 000,000,000 | -H-D | C] -- C:\Windows\PIF
[2012/10/05 12:19:03 | 000,000,000 | ---D | C] -- C:\ProgramData\SMR311
[2012/10/05 12:18:49 | 000,097,440 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SMR311.SYS
[2012/10/05 12:18:41 | 000,000,000 | ---D | C] -- C:\Users\Guy\AppData\Local\NPE
[2012/10/05 12:18:03 | 002,957,840 | ---- | C] (Symantec Corporation) -- C:\Users\Guy\Desktop\NPE.exe
[2012/10/05 11:47:09 | 000,141,944 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2012/10/05 11:47:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2012/10/05 11:47:08 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2012/10/05 11:45:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\N360
[2012/10/05 11:45:10 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
[2012/10/05 11:45:10 | 000,000,000 | ---D | C] -- C:\Program Files\Norton 360
[2012/10/05 11:45:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012/10/05 11:41:11 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2012/10/05 11:41:11 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller

========== Files - Modified Within 30 Days ==========

[2012/10/10 16:27:53 | 000,013,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/10 16:27:53 | 000,013,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/10 16:25:30 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/10 16:25:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/10/10 16:25:21 | 1507,725,312 | -HS- | M] () -- C:\hiberfil.sys
[2012/10/10 16:23:01 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2012/10/10 15:19:12 | 000,000,512 | ---- | M] () -- C:\Users\Guy\Desktop\MBR.dat
[2012/10/10 15:17:14 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Guy\Desktop\aswMBR.exe
[2012/10/10 14:58:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Guy\Desktop\OTL.exe
[2012/10/10 14:47:15 | 000,016,410 | ---- | M] () -- C:\Users\Guy\Documents\cc_20121010_144711.reg
[2012/10/10 14:46:51 | 000,009,166 | ---- | M] () -- C:\Users\Guy\Documents\cc_20121010_144647.reg
[2012/10/10 14:46:32 | 000,016,658 | ---- | M] () -- C:\Users\Guy\Documents\cc_20121010_144626.reg
[2012/10/10 14:46:03 | 000,283,036 | ---- | M] () -- C:\Users\Guy\Documents\cc_20121010_144553.reg
[2012/10/10 13:38:34 | 000,292,552 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/10/05 15:49:40 | 000,002,226 | ---- | M] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2012/10/05 15:49:11 | 001,299,925 | ---- | M] () -- C:\Windows\System32\drivers\N360\0604000.009\Cat.DB
[2012/10/05 12:52:27 | 000,009,103 | ---- | M] () -- C:\Windows\System32\drivers\N360\0604000.009\VT20121002.018
[2012/10/05 12:18:49 | 000,097,440 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SMR311.SYS
[2012/10/05 12:18:10 | 002,957,840 | ---- | M] (Symantec Corporation) -- C:\Users\Guy\Desktop\NPE.exe
[2012/10/05 11:49:29 | 000,628,460 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/10/05 11:49:29 | 000,110,612 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/10/05 11:47:09 | 000,007,468 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2012/10/05 11:47:08 | 000,141,944 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2012/10/05 11:47:08 | 000,000,806 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2012/09/26 11:52:07 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\N360\0604000.009\isolate.ini
[2012/09/14 21:59:53 | 000,001,995 | ---- | M] () -- C:\Users\Guy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/09/12 13:35:40 | 000,002,061 | ---- | M] () -- C:\Users\Guy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk

========== Files Created - No Company Name ==========

[2012/10/10 15:19:12 | 000,000,512 | ---- | C] () -- C:\Users\Guy\Desktop\MBR.dat
[2012/10/10 14:47:13 | 000,016,410 | ---- | C] () -- C:\Users\Guy\Documents\cc_20121010_144711.reg
[2012/10/10 14:46:49 | 000,009,166 | ---- | C] () -- C:\Users\Guy\Documents\cc_20121010_144647.reg
[2012/10/10 14:46:29 | 000,016,658 | ---- | C] () -- C:\Users\Guy\Documents\cc_20121010_144626.reg
[2012/10/10 14:45:59 | 000,283,036 | ---- | C] () -- C:\Users\Guy\Documents\cc_20121010_144553.reg
[2012/10/10 13:03:53 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/10/10 13:03:53 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/10/10 13:03:53 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/10/10 13:03:53 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/10/10 13:03:53 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/10/05 15:49:40 | 000,002,226 | ---- | C] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2012/10/05 15:48:01 | 001,299,925 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\Cat.DB
[2012/10/05 12:53:19 | 000,009,103 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\VT20121002.018
[2012/10/05 12:52:22 | 000,007,492 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symds.cat
[2012/10/05 12:52:22 | 000,007,458 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symnet.cat
[2012/10/05 12:52:22 | 000,007,434 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symefa.cat
[2012/10/05 12:52:22 | 000,007,398 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\srtspx.cat
[2012/10/05 12:52:22 | 000,003,435 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symefa.inf
[2012/10/05 12:52:22 | 000,002,852 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symds.inf
[2012/10/05 12:52:22 | 000,001,441 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\symnet.inf
[2012/10/05 12:52:22 | 000,001,388 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\srtspx.inf
[2012/10/05 12:52:21 | 000,007,450 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\iron.cat
[2012/10/05 12:52:21 | 000,007,446 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\ccsetx86.cat
[2012/10/05 12:52:21 | 000,007,380 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\srtsp.cat
[2012/10/05 12:52:21 | 000,001,388 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\srtsp.inf
[2012/10/05 12:52:21 | 000,000,827 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\ccsetx86.inf
[2012/10/05 12:52:21 | 000,000,742 | R--- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\iron.inf
[2012/10/05 12:51:40 | 000,000,172 | ---- | C] () -- C:\Windows\System32\drivers\N360\0604000.009\isolate.ini
[2012/10/05 11:47:09 | 000,007,468 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2012/10/05 11:47:09 | 000,000,806 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2012/04/30 14:11:36 | 000,001,233 | ---- | C] () -- C:\Windows\System32\rar.exe
[2012/01/27 12:56:00 | 000,000,000 | ---- | C] () -- C:\Windows\System32\link.sys
[2012/01/03 16:18:12 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

========== ZeroAccess Check ==========

[2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/02/21 02:24:52 | 000,000,000 | ---D | M] -- C:\Users\Guy\AppData\Roaming\FileZilla
[2012/05/23 09:23:37 | 000,000,000 | ---D | M] -- C:\Users\Guy\AppData\Roaming\Gmote
[2012/02/24 12:49:46 | 000,000,000 | ---D | M] -- C:\Users\Guy\AppData\Roaming\OpenOffice.org
[2012/07/21 16:12:00 | 000,000,000 | ---D | M] -- C:\Users\Guy\AppData\Roaming\OSByPetzl
[2012/03/26 00:27:43 | 000,000,000 | ---D | M] -- C:\Users\Guy\AppData\Roaming\Scribus
[2012/02/16 11:24:37 | 000,000,000 | ---D | M] -- C:\Users\Guy\AppData\Roaming\SecurityHeroes
[2012/02/14 08:27:30 | 000,000,000 | ---D | M] -- C:\Users\Guy\AppData\Roaming\Thunderbird
[2012/10/10 13:33:29 | 000,000,000 | ---D | M] -- C:\Users\Guy\AppData\Roaming\TuneUp Software

========== Purity Check ==========



< End of report >

[Essexboy]

For the external drives we could use AVP .. But be aware this may take a while as it does a very thorough scan
The drives will need to be connected

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop ( it will be randomly named )

First we will run a virus scan
On the first tab select all elements down to and including All removable drives and then select start scan
Once it has finished select report and post that.



Do not close AVPTool or it will self uninstall, if it does uninstall - - then just rerun the setup file on your desktop

Now an analysis scan
Select the Manual Disinfection tab
Press the Gather System Information button
Once done Open the last report saved folder then attach the zip file to your next post zip
The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

[climberguy]

attached is latest log  avptool_sysinfo.zip   10.96KB   214 downloads

[Essexboy]

It appears to be on your G drive, ensure that it is plugged in when you run the script. Also if the project1 is running then do not stop it but run a fresh OTL log, that way I may be able to determine where it is originating

• Re-run AVPTool
• Select the Manual Disinfection tab
• Where it states Step 3 paste in the following disinfection script and press execute
  
  

  begin
  SetAVZPMStatus(True);
  SetAVZGuardStatus(True);
  SearchRootkit(true, true);
   DeleteFile('G:\bf16d2f6432f138487d253e5736dad29\DW\DW20.exe');
   BC_DeleteFile('G:\bf16d2f6432f138487d253e5736dad29\DW\DW20.exe');
  BC_ImportDeletedList;
  BC_ImportAll;
  ExecuteSysClean;
  BC_Activate;
  RebootWindows(true);
  end.
  

  
  
• Your system will reboot on completion, if it does not please do so yourself
• On completion please run another analysis scan and attach the zip file

[climberguy]

ok done. hopefully thisis it sorted.
 avptool_sysinfo.zip   11.46KB   217 downloads

Cheers Guy

[Essexboy]

How is the computer behaving now ?

[climberguy]

Still some files that I can't get rid of, and I'm still getting some symptoms of the infection. When I play music files I'm getting something that sounds like vinyl crackle over the top of the music, which gets worse with time.
Does seem to be running faster though.

Guy

[Essexboy]

What files are those ?

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
  
  
  
  
  
• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[climberguy]

unable to turn off my anti virus software for some reason. I still have the sound defects, but machine seems to be running faster again.

ComboFix 12-10-10.02 - Guy 10/10/2012 23:38:42.2.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.44.1033.18.1917.1409 [GMT 1:00]
Running from: c:\users\Guy\Desktop\ComboFix.exe
AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-09-10 to 2012-10-10 )))))))))))))))))))))))))))))))
.
.
2012-10-10 22:48 . 2012-10-10 22:48 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-10 20:08 . 2012-10-10 20:08 11264 ----a-w- c:\windows\system32\drivers\uzc2otiw.sys
2012-10-10 18:16 . 2012-10-10 18:16 -------- d-----w- c:\programdata\Kaspersky Lab
2012-10-10 15:22 . 2012-10-10 15:22 -------- d-----w- C:\_OTL
2012-10-10 13:54 . 2012-10-10 13:54 -------- d-----w- c:\users\Guy\AppData\Local\Avg2013
2012-10-10 12:33 . 2012-10-10 12:33 -------- d-----w- c:\users\Guy\AppData\Roaming\TuneUp Software
2012-10-10 12:14 . 2012-10-10 22:48 -------- d-----w- c:\users\Guy\AppData\Local\temp
2012-10-10 12:04 . 2012-10-10 13:54 -------- d-----w- c:\programdata\MFAData
2012-10-10 12:04 . 2012-10-10 12:04 -------- d--h--w- c:\programdata\Common Files
2012-10-10 12:04 . 2012-10-10 12:04 -------- d-----w- c:\users\Guy\AppData\Local\MFAData
2012-10-05 11:49 . 2012-10-05 11:49 -------- d-----w- c:\windows\system32\N360_BACKUP
2012-10-05 11:26 . 2012-10-05 11:26 -------- d--h--w- c:\windows\PIF
2012-10-05 11:19 . 2012-10-05 11:19 -------- d-----w- c:\programdata\SMR311
2012-10-05 11:18 . 2012-10-05 11:18 97440 ----a-w- c:\windows\system32\drivers\SMR311.SYS
2012-10-05 11:18 . 2012-10-05 11:23 -------- d-----w- c:\users\Guy\AppData\Local\NPE
2012-10-05 10:50 . 2012-08-30 08:17 6980552 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0DFDF885-B581-4E74-BDD7-504D792569C0}\mpengine.dll
2012-10-05 10:47 . 2012-10-05 10:47 141944 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2012-10-05 10:47 . 2012-10-05 10:50 -------- d-----w- c:\program files\Common Files\Symantec Shared
2012-10-05 10:47 . 2012-10-05 10:47 -------- d-----w- c:\program files\Symantec
2012-10-05 10:45 . 2012-10-05 14:49 -------- d-----w- c:\windows\system32\drivers\N360
2012-10-05 10:45 . 2012-10-05 10:45 -------- d-----w- c:\program files\Norton 360
2012-10-05 10:45 . 2012-10-05 11:18 -------- d-----w- c:\programdata\Norton
2012-10-05 10:41 . 2012-10-05 10:41 -------- d-----w- c:\program files\NortonInstaller
2012-10-01 09:30 . 2012-08-21 20:12 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-09-14 20:59 . 2012-09-14 20:59 73696 ----a-w- c:\program files\Mozilla Firefox\breakpadinjector.dll
2012-09-12 11:49 . 2012-05-05 07:46 400896 ----a-w- c:\windows\system32\srcore.dll
2012-09-12 11:49 . 2012-05-14 04:33 769024 ----a-w- c:\windows\system32\localspl.dll
2012-09-12 11:49 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-09-12 11:49 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-09-12 11:49 . 2012-08-22 17:16 1292144 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-12 11:49 . 2012-08-22 17:16 240496 ----a-w- c:\windows\system32\drivers\netio.sys
2012-09-12 11:49 . 2012-08-22 17:16 187760 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-12 11:49 . 2012-07-18 17:47 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-09-12 11:49 . 2012-02-11 05:43 492032 ----a-w- c:\windows\system32\win32spl.dll
2012-09-12 11:49 . 2012-02-11 05:37 317440 ----a-w- c:\windows\system32\spoolsv.exe
2012-09-12 11:48 . 2012-08-02 16:57 490496 ----a-w- c:\windows\system32\d3d10level9.dll
2012-09-12 11:48 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll
2012-09-12 11:48 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-10 15:05 . 2012-04-10 07:29 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-10 15:05 . 2012-02-16 10:21 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-14 20:59 . 2012-02-20 15:24 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
.
c:\users\Guy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
_uninst_14440365.lnk - c:\users\Guy\AppData\Local\temp\_uninst_14440365.bat [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"=hex(0):
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 15:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=N360&pvid=6.0.0.145
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Guy\AppData\Roaming\Mozilla\Firefox\Profiles\mlhkgxhj.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/home.php
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-ROC_ROC_NT - c:\program files\AVG Secure Search\ROC_ROC_NT.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\6.4.0.9\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\6.4.0.9\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-10-10 23:49:50
ComboFix-quarantined-files.txt 2012-10-10 22:49
ComboFix2.txt 2012-10-10 12:14
.
Pre-Run: 72,916,127,744 bytes free
Post-Run: 72,872,701,952 bytes free
.
- - End Of File - - 56BFD604DEF7E574BBBD9D036DC2A396

[Essexboy]

What sound card do you have ? Have you tried updating the driver ?

Lets have a quick sweep for orphans

Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

[climberguy]

tbh not quite surewhich sound card I have. The drivers are all upto date though.
I ran the lastscan twice. The quick scan came back clean, and the full scan picked up a couple of things on the external. Logs below.

Quick scan
Malwarebytes Anti-Malware (Trial) 1.65.0.1400
www.malwarebytes.org

Database version: v2012.10.11.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Guy :: SARAH [administrator]

Protection: Enabled

11/10/2012 14:19:19
mbam-log-2012-10-11 (14-19-19).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 189817
Time elapsed: 5 minute(s), 17 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


full scan

Malwarebytes Anti-Malware (Trial) 1.65.0.1400
www.malwarebytes.org

Database version: v2012.10.11.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Guy :: SARAH [administrator]

Protection: Enabled

11/10/2012 14:26:19
mbam-log-2012-10-11 (14-26-19).txt

Scan type: Full scan (C:\|G:\|S:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 309046
Time elapsed: 59 minute(s), 22 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 4
C:\Qoobox\Quarantine\G\Backup.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\G\Music.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\G\Photos.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\G\Videos.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.

(end)