I have saved a text log of my Norton Internet Security history. Would it be relevant to post the entire log here? I would proceed with the instructions as followed if not for the scan error mentioned above.
Anway perhaps a history of my Resolved Security Risks could help:
Category: Resolved Security Risks
Date & Time,Severity,Activity,Status,Recommended Action,Component,Definitions Version,ERASER Version,Risk Name,Risk Category,Risk Type,Risk State,File Name
1/11/2009 1:09 AM,High,Trojan Horse detected by Auto-Protect,Quarantined,Resolved - No Action,Auto-Protect,2009.10.31.004,109.2.2.4,Trojan Horse,Virus,File Based,Fully removed,
12/10/2009 6:49 PM,High,extra_uninst.exe detected by SONAR,Quarantined,Resolved - No Action,SONAR,2009.10.11.020,109.2.2.4,extra_uninst .exe,,File Based,Fully removed,
14/9/2009 7:10 PM,High,Infostealer.Gampass detected by Auto-Protect,Quarantined,Resolved - No Action,Auto-Protect,2009.09.13.019,109.2.0.124,Infostealer.Gam pass,Virus,File Based,Fully removed,
23/6/2009 11:15 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,c:\users\quanxian g\appdata\local\temp\rar$ex16.968\rld-aakg.exe
23/6/2009 11:13 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,d:\users\quanxian g\documents\games\ana\rld-aakg.exe
23/6/2009 11:12 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,c:\users\quanxian g\appdata\local\temp\rar$ex00.834\rld-aakg.exe
23/6/2009 11:12 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,d:\users\quanxian g\documents\games\ana\rld-aakg.exe
23/6/2009 11:11 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,c:\users\quanxian g\appdata\local\temp\rar$ex01.353\rld-aakg.exe
And the quarantine log:
Category: Quarantine
Date & Time,Severity,Activity,Status,Recommended Action,Component,Definitions Version,ERASER Version,Risk Name,Risk Category,Risk Type,Risk State
1/11/2009 1:09 AM,High,Trojan Horse detected by Auto-Protect,Quarantined,Resolved - No Action,Auto-Protect,2009.10.31.004,109.2.2.4,Trojan Horse,Virus,File Based,Fully removed
14/9/2009 7:10 PM,High,Infostealer.Gampass detected by Auto-Protect,Quarantined,Resolved - No Action,Auto-Protect,2009.09.13.019,109.2.0.124,Infostealer.Gam pass,Virus,File Based,Fully removed
I have to sleep soon. I will check back on replies tomorrow. Thanks!
EDIT: Adding in some more just in case it's my firewall blocking the links or something (only the first few lines of the logs)
Category: Firewall - Activities
Date & Time,Severity,Activity,Status,Recommended Action,Category,Program Name,Program Path,Default Action,Action Taken,Local Computer,Traffic Description
4/11/2009 10:23 PM,Info,"An instance of \"<path>C:\Users\Quanxiang\AppData\Local\Temp\b.ex e</path>\" is preparing to access the Internet.",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:21 PM,Info,"Rule \"Default Block UPnP Discovery\" stealthed (192.168.0.198, Port ssdp(1900) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:21 PM,Info,"Rule \"Default Block UPnP Discovery\" stealthed (192.168.0.198, Port ssdp(1900) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:21 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:16 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:16 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:16 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:15 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:14 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
Category: Intrusion Prevention
Date & Time,Severity,Activity,Status,Recommended Action,Category,Risk Name,Attacking Computer,Attacker URL,Destination Address,Source Address,Traffic Description
4/11/2009 6:59 PM,Info,Intrusion Prevention has been enabled,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 6:59 PM,Info,Intrusion Prevention is monitoring 1481 signatures. Driver version: 9.1.2.5,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 6:59 PM,Info,Intrusion Prevention Engine version: 4.5.0.67 Definitions Set version: 20091102.002,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 11:37 AM,Info,Intrusion Prevention is monitoring 1481 signatures. Driver version: 9.1.2.5,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 11:37 AM,Info,Intrusion Prevention Engine version: 4.5.0.67 Definitions Set version: 20091102.002,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 11:37 AM,Info,Intrusion Prevention has been enabled,Detected,No Action Required,Intrusion Prevention,,,,,,
3/11/2009 10:52 PM,High,"An intrusion attempt by 174.36.195.3 was blocked. Application path <path>\DEVICE\HARDDISKVOLUME1\USERS\QUANXIANG\APPD ATA\LOCAL\TEMP\B.EXE</path>",Blocked,No Action Required,,HTTP Acrobat PDF Suspicious File Download 3,"174.36.195.3, 8080",mette.servecounterstrike.com:8080/pics/ChangeLog.pdf,"JIAMIN-PC (192.168.0.197, 60094)",174.36.195.3,"TCP, http-proxy"
3/11/2009 5:28 PM,Info,Intrusion Prevention is monitoring 1481 signatures. Driver version: 9.1.2.5,Detected,No Action Required,Intrusion Prevention,,,,,,
Anway perhaps a history of my Resolved Security Risks could help:
Category: Resolved Security Risks
Date & Time,Severity,Activity,Status,Recommended Action,Component,Definitions Version,ERASER Version,Risk Name,Risk Category,Risk Type,Risk State,File Name
1/11/2009 1:09 AM,High,Trojan Horse detected by Auto-Protect,Quarantined,Resolved - No Action,Auto-Protect,2009.10.31.004,109.2.2.4,Trojan Horse,Virus,File Based,Fully removed,
12/10/2009 6:49 PM,High,extra_uninst.exe detected by SONAR,Quarantined,Resolved - No Action,SONAR,2009.10.11.020,109.2.2.4,extra_uninst .exe,,File Based,Fully removed,
14/9/2009 7:10 PM,High,Infostealer.Gampass detected by Auto-Protect,Quarantined,Resolved - No Action,Auto-Protect,2009.09.13.019,109.2.0.124,Infostealer.Gam pass,Virus,File Based,Fully removed,
23/6/2009 11:15 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,c:\users\quanxian g\appdata\local\temp\rar$ex16.968\rld-aakg.exe
23/6/2009 11:13 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,d:\users\quanxian g\documents\games\ana\rld-aakg.exe
23/6/2009 11:12 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,c:\users\quanxian g\appdata\local\temp\rar$ex00.834\rld-aakg.exe
23/6/2009 11:12 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,d:\users\quanxian g\documents\games\ana\rld-aakg.exe
23/6/2009 11:11 AM,High,Auto-Protect has detected Trojan Horse,"Blocked, Blocked",Resolved - No Action,Auto-Protect,2009.06.22.033,,,Virus,,,c:\users\quanxian g\appdata\local\temp\rar$ex01.353\rld-aakg.exe
And the quarantine log:
Category: Quarantine
Date & Time,Severity,Activity,Status,Recommended Action,Component,Definitions Version,ERASER Version,Risk Name,Risk Category,Risk Type,Risk State
1/11/2009 1:09 AM,High,Trojan Horse detected by Auto-Protect,Quarantined,Resolved - No Action,Auto-Protect,2009.10.31.004,109.2.2.4,Trojan Horse,Virus,File Based,Fully removed
14/9/2009 7:10 PM,High,Infostealer.Gampass detected by Auto-Protect,Quarantined,Resolved - No Action,Auto-Protect,2009.09.13.019,109.2.0.124,Infostealer.Gam pass,Virus,File Based,Fully removed
I have to sleep soon. I will check back on replies tomorrow. Thanks!
EDIT: Adding in some more just in case it's my firewall blocking the links or something (only the first few lines of the logs)
Category: Firewall - Activities
Date & Time,Severity,Activity,Status,Recommended Action,Category,Program Name,Program Path,Default Action,Action Taken,Local Computer,Traffic Description
4/11/2009 10:23 PM,Info,"An instance of \"<path>C:\Users\Quanxiang\AppData\Local\Temp\b.ex e</path>\" is preparing to access the Internet.",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:21 PM,Info,"Rule \"Default Block UPnP Discovery\" stealthed (192.168.0.198, Port ssdp(1900) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:21 PM,Info,"Rule \"Default Block UPnP Discovery\" stealthed (192.168.0.198, Port ssdp(1900) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:21 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:16 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:16 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:16 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:15 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
4/11/2009 10:14 PM,Info,"Rule \"Default Block LLMNR\" stealthed (192.168.0.199, Port (5355) ). Inbound UDP packet. ",Detected,No Action Required,Firewall - Activities,,,,,,
Category: Intrusion Prevention
Date & Time,Severity,Activity,Status,Recommended Action,Category,Risk Name,Attacking Computer,Attacker URL,Destination Address,Source Address,Traffic Description
4/11/2009 6:59 PM,Info,Intrusion Prevention has been enabled,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 6:59 PM,Info,Intrusion Prevention is monitoring 1481 signatures. Driver version: 9.1.2.5,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 6:59 PM,Info,Intrusion Prevention Engine version: 4.5.0.67 Definitions Set version: 20091102.002,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 11:37 AM,Info,Intrusion Prevention is monitoring 1481 signatures. Driver version: 9.1.2.5,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 11:37 AM,Info,Intrusion Prevention Engine version: 4.5.0.67 Definitions Set version: 20091102.002,Detected,No Action Required,Intrusion Prevention,,,,,,
4/11/2009 11:37 AM,Info,Intrusion Prevention has been enabled,Detected,No Action Required,Intrusion Prevention,,,,,,
3/11/2009 10:52 PM,High,"An intrusion attempt by 174.36.195.3 was blocked. Application path <path>\DEVICE\HARDDISKVOLUME1\USERS\QUANXIANG\APPD ATA\LOCAL\TEMP\B.EXE</path>",Blocked,No Action Required,,HTTP Acrobat PDF Suspicious File Download 3,"174.36.195.3, 8080",mette.servecounterstrike.com:8080/pics/ChangeLog.pdf,"JIAMIN-PC (192.168.0.197, 60094)",174.36.195.3,"TCP, http-proxy"
3/11/2009 5:28 PM,Info,Intrusion Prevention is monitoring 1481 signatures. Driver version: 9.1.2.5,Detected,No Action Required,Intrusion Prevention,,,,,,





























Linear Mode

