Ok, so I downloaded malwarebytes and scanned. I've posted the below report from the scan and removal. It only found 30 files where avg found over 100. Should I still be concerned?
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 6/27/2015
Scan Time: 9:10:56 AM
Logfile:
Administrator: Yes
Version: 2.01.6.1022
Malware Database: v2015.06.27.02
Rootkit Database: v2015.06.26.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 8.1
CPU: x64
File System: NTFS
User: Joshua
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 349991
Time Elapsed: 24 min, 13 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 14
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, Quarantined, [565811ae1a7062d4b5fde3af08fd03fd],
PUP.Optional.SuperOptimizer.C, HKLM\SOFTWARE\WOW6432NODE{1146AC44-2F03-4431-B4FD-889BC837521F}, Quarantined, [e8c62c938dfde254baf3cbc9e61fe51b],
PUP.Optional.SuperOptimizer.C, HKLM\SOFTWARE\WOW6432NODE{6791A2F3-FC80-475C-A002-C014AF797E9C}, Quarantined, [3d713788ee9cf640d3db7a1a11f48f71],
PUP.Optional.Vosteran.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\MEDIAPLAYER\SHIMINCLUSIONLIST\vosteran.exe, Quarantined, [a30b259a7c0ee6500e0c3ac9c341a25e],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{d164f2af}, Quarantined, [00aec3fc8ffb2511ce35efa291743cc4],
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE, Quarantined, [317dc4fb7713999dddd54d4506ffe61a],
PUP.Optional.FasterLight.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util Faster Light, Quarantined, [a6084f70b0da84b2fc93f9148f75de22],
PUP.Optional.SuperOptimizer.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW{1146AC44-2F03-4431-B4FD-889BC837521F}, Quarantined, [b8f6d0efdcae39fdd3d91a7a689df709],
PUP.Optional.InstallCore.C, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\InstallCore, Quarantined, [05a9c2fd56347db91a8e33619c690bf5],
PUP.Optional.Vosteran.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\Vosteran, Quarantined, [b1fd08b7c2c892a49b600afe857fd52b],
PUP.Optional.Vosteran.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\Vosteran Browser, Quarantined, [79357847addd1620cd2e897f4db7ea16],
PUP.Optional.SuperOptimizer.C, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\APPDATALOW{1146AC44-2F03-4431-B4FD-889BC837521F}, Quarantined, [228c2897d7b3a3933577b8dc36cfa15f],
PUP.Optional.Vosteran.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [4767edd2771393a3c710ea9e778edb25],
PUP.Optional.OptimizerPro.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\OPTIMIZER PRO, Quarantined, [6945c8f705859a9c75e1e3affa0be21e],
Registry Values: 5
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, Quarantined, [565811ae1a7062d4b5fde3af08fd03fd]
PUP.Optional.Vosteran.C, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\WSE_Vosteran\, Quarantined, [e3cb922dc4c671c5588d6791f21111ef]
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, Quarantined, [317dc4fb7713999dddd54d4506ffe61a]
PUP.Optional.Vosteran.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Vosteran, Quarantined, [4767edd2771393a3c710ea9e778edb25]
PUP.Optional.OptimizerPro.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\OPTIMIZER PRO|AdsBuyNowURL, http://www.safeshopgate.com/r?s=121000600&g=C56A7C8D-CA42-4BA1-EF84-B553D789EC27, Quarantined, [6945c8f705859a9c75e1e3affa0be21e]
Registry Data: 0
(No malicious items detected)
Folders: 6
PUP.Optional.UpdateProc.A, C:\Users\Joshua\AppData\Roaming\UpdaterEX\UpdateProc, Quarantined, [5658962929611e1837d46a8d05fe25db],
PUP.Optional.UpdateProc.A, C:\Users\Joshua\AppData\Roaming\UpdaterEX, Quarantined, [5658962929611e1837d46a8d05fe25db],
PUP.Optional.OptimizerPro.A, C:\Users\Joshua\Documents\Optimizer Pro, Quarantined, [f8b6457a088248ee5301eba700056997],
Rogue.Multiple, C:\ProgramData\1078601655, Quarantined, [baf4902f17730e28fa6fa21142c19769],
PUP.Optional.UltraCoupon.A, C:\ProgramData\UltraCoupon, Quarantined, [c4ea605fabdf39fddfadfee8af54f50b],
PUP.Optional.WorldWideWebCoupon.A, C:\ProgramData\WorldWideWebCoupon, Quarantined, [1896625d7e0c60d65a83816fb053bb45],
Files: 5
PUP.Optional.MultiPlug.Uns, C:\ProgramData\UltraCoupon\UltraCoupon.exe, Quarantined, [f7b707b84a4056e0df5fadba9073f709],
PUP.Optional.MultiPlug.Uns, C:\ProgramData\WorldWideWebCoupon\WorldWideWebCoupon.exe, Quarantined, [6e40e6d99bef71c5d866db8c976ccf31],
PUP.Optional.UpdateProc.A, C:\Users\Joshua\AppData\Roaming\UpdaterEX\UpdateProc\prod.dat, Quarantined, [5658962929611e1837d46a8d05fe25db],
PUP.Optional.UpdateProc.A, C:\Users\Joshua\AppData\Roaming\UpdaterEX\UpdateProc\config.dat, Quarantined, [5658962929611e1837d46a8d05fe25db],
PUP.Optional.OptimizerPro.A, C:\Users\Joshua\Documents\Optimizer Pro\CookiesException.txt, Quarantined, [f8b6457a088248ee5301eba700056997],
Physical Sectors: 0
(No malicious items detected)
(end)
Joshua, Vosteran… Have you tried Malwarebytes Free?.
AVG Guru
No I haven't, I"ll try it and report back.
Thanks,
They cannot be infected! You can ignore these detection.
This might also help: JSON formatter (https://jsonformatter-online.com/) tool
Hello Joshua. Thank you for posting the logs. I would like to inform you that all the files that AVG said they can not be scanned are locked files. Locked files are the files in use by other process (operating system) and mostly critical in use. As they are still locked by system, they cannot be infected. You can ignore these detection. Thank you.
I continue to have a persistent virus imbedded in a program name Vosteran that came with my new laptop. I uninstalled it several months ago and today AVG found another virus in the program. On further research I found the program and reinstalled itself. I booted into safe mode and deleted the program folder and any files I found that were associated with the program.
Then I ran the AVG AntiVirus Command Line and here are the results. It found a whole bunch of stuff, but didn't fix any of them. Any advice?
AVG 2015 AntiVirus command line scanner
Copyright (c) 1992 - 2015 AVG Technologies
Program version 2015.0.6037, engine 2015.0.4365
Virus Database: Version 4365/10108 2015-06-27
C:\Documents and Settings\ Locked file. Not scanned. is OK.
C:\hiberfil.sys Locked file. Not scanned. is OK.
C:\pagefile.sys Locked file. Not scanned. is OK.
C:\ProgramData\Desktop\ Locked file. Not scanned. is OK.
C:\ProgramData\Documents\ Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\05602a264a71926c4f000a2a70dc6ab2_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0cac9aa19f004c6eb27e8fd1e87c8fc5_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\1f08219ff61566d7d2ffc2d9d3bea908_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\21dc4291e2872b39ea1058df9cd99f54_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\322251bd58574d9d277c49ad94fbf19c_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\33a2a0efe5e43b77052849408ebd5ca1_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3fc6efa9bbc50bcd8e1d737b3f616e47_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\408c23bca2ad460e3c2591a4872df1cc_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\46294e468e2788d76d99d3608c11b270_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\47177ace210d5d5474476774f5b962d5_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\48b8b5288abda7e7456c4f89c2984769_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\573bb85d8e833737bb77ea9d64511d16_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\58b1536c5838eecc6606f3031fb217bd_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5a9120658328b79031aae226124844f6_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5ae7fe9bcad1e50cbca954cca0a9343d_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5decafa8f7c9c66058450e80092d8933_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6546da8eda080f8c7c0fc73010550b39_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\66bdb9865cf3ad137c9511794f96d58e_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6e8974c8a1a42dd09d633ee469dda6a2_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\704a064827d86bda0e67c558f9e48984_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\813f87b038ce314652904400babb0ed6_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9051e6e5cfdcd2809f0f2240f3177844_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\975e93cea901fbf21602069d90638254_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a16ff6ae70cdb0d4daf3351604a612e5_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a18b82e684b6ba9890277cee6ce3ca5b_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ac58c22b3c11e8dba457f65a92524ac9_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b00c2b0d0b1393aefea74739321dcd1a_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b4838e66fa566d424617b4df327d276a_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b56b0de078fadaa044cbfb68d90389ae_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b6bb4e9d7ebf8e875bdb7e1755ac342d_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d7818d28273d57ef10e8317c9996703f_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\da0750dd961bd46c6ef86bb25d334999_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\db9049205e4a87b90e5e05c6ba66d68b_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ddceb3d48ba0114dc5bf370531fea224_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e231d6e60e244b2cdd85dd0ea87a7f28_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e68bf9ddf1b9af7fd514d0b7c265e0eb_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e7785229832623ece8a5038cc0be79e1_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e9b51237b79a582d70423d08a7616759_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ef888ca2b5ed6bed7916f1bf5604af19_d0e1889a-dab9-4a9f-a8ca-ebb12e72f061 Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\cfc.flights.json Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Diagnosis\events00.rbs Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Diagnosis\events01.rbs Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Diagnosis\events10.rbs Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Diagnosis\events11.rbs Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Diagnosis\users.dat Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Windows\LocationProvider\ Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Windows\SystemData\ Locked file. Not scanned. is OK.
C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\MpScanCache-1.bin Locked file. Not scanned. is OK.
C:\ProgramData\Templates\ Locked file. Not scanned. is OK.
C:\swapfile.sys Locked file. Not scanned. is OK.
C:\System Recovery\ Locked file. Not scanned. is OK.
C:\System Volume Information\ Locked file. Not scanned. is OK.
C:\Users\Default\AppData\Local\History\ Locked file. Not scanned. is OK.
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\ Locked file. Not scanned. is OK.
C:\Users\Default\AppData\Local\Temporary Internet Files\ Locked file. Not scanned. is OK.
C:\Users\Default\Cookies\ Locked file. Not scanned. is OK.
C:\Users\Default\Documents\My Music\ Locked file. Not scanned. is OK.
C:\Users\Default\Documents\My Pictures\ Locked file. Not scanned. is OK.
C:\Users\Default\Documents\My Videos\ Locked file. Not scanned. is OK.
C:\Users\Default\NetHood\ Locked file. Not scanned. is OK.
C:\Users\Default\PrintHood\ Locked file. Not scanned. is OK.
C:\Users\Default\Recent\ Locked file. Not scanned. is OK.
C:\Users\Default\Templates\ Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\History\ Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\ Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5\ Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\Microsoft\Windows\Notifications\WPNPRMRY.tmp Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\Microsoft\Windows\UsrClass.dat Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\Microsoft\Windows\WebCache\V01.log Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat Locked file. Not scanned. is OK.
C:\Users\Joshua\AppData\Local\Microsoft\Windows\WebCacheLock.dat Locked file. Not scanned. is OK.
C:\Users\Joshua\Documents\My Music\ Locked file. Not scanned. is OK.
C:\Users\Joshua\Documents\My Pictures\ Locked file. Not scanned. is OK.
C:\Users\Joshua\Documents\My Videos\ Locked file. Not scanned. is OK.
C:\Users\Joshua\NetHood\ Locked file. Not scanned. is OK.
C:\Users\Joshua\NTUSER.DAT Locked file. Not scanned. is OK.
C:\Users\Joshua\ntuser.dat.LOG1 Locked file. Not scanned. is OK.
C:\Users\Joshua\ntuser.dat.LOG2 Locked file. Not scanned. is OK.
C:\Users\Joshua\PrintHood\ Locked file. Not scanned. is OK.
C:\Users\Joshua\Templates\ Locked file. Not scanned. is OK.
C:\Users\Public\Documents\My Music\ Locked file. Not scanned. is OK.
C:\Users\Public\Documents\My Pictures\ Locked file. Not scanned. is OK.
C:\Users\Public\Documents\My Videos\ Locked file. Not scanned. is OK.
C:\Windows\Resources\Themes\aero\VSCache\Aero.msstyles_1033_96.mss Locked file. Not scanned. is OK.
C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT Locked file. Not scanned. is OK.
C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1 Locked file. Not scanned. is OK.
C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2 Locked file. Not scanned. is OK.
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT Locked file. Not scanned. is OK.
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1 Locked file. Not scanned. is OK.
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2 Locked file. Not scanned. is OK.
C:\Windows\System32\catroot2\edb.log Locked file. Not scanned. is OK.
C:\Windows\System32\catroot2{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Locked file. Not scanned. is OK.
C:\Windows\System32\catroot2{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Locked file. Not scanned. is OK.
C:\Windows\System32\config\BBI Locked file. Not scanned. is OK.
C:\Windows\System32\config\BBI.LOG1 Locked file. Not scanned. is OK.
C:\Windows\System32\config\BBI.LOG2 Locked file. Not scanned. is OK.
C:\Windows\System32\config\DEFAULT Locked file. Not scanned. is OK.
C:\Windows\System32\config\DEFAULT.LOG1 Locked file. Not scanned. is OK.
C:\Windows\System32\config\DEFAULT.LOG2 Locked file. Not scanned. is OK.
C:\Windows\System32\config\RegBack\DEFAULT Locked file. Not scanned. is OK.
C:\Windows\System32\config\RegBack\SAM Locked file. Not scanned. is OK.
C:\Windows\System32\config\RegBack\SECURITY Locked file. Not scanned. is OK.
C:\Windows\System32\config\RegBack\SOFTWARE Locked file. Not scanned. is OK.
C:\Windows\System32\config\RegBack\SYSTEM Locked file. Not scanned. is OK.
C:\Windows\System32\config\SAM Locked file. Not scanned. is OK.
C:\Windows\System32\config\SAM.LOG1 Locked file. Not scanned. is OK.
C:\Windows\System32\config\SAM.LOG2 Locked file. Not scanned. is OK.
C:\Windows\System32\config\SECURITY Locked file. Not scanned. is OK.
C:\Windows\System32\config\SECURITY.LOG1 Locked file. Not scanned. is OK.
C:\Windows\System32\config\SECURITY.LOG2 Locked file. Not scanned. is OK.
C:\Windows\System32\config\SOFTWARE Locked file. Not scanned. is OK.
C:\Windows\System32\config\SOFTWARE.LOG1 Locked file. Not scanned. is OK.
C:\Windows\System32\config\SOFTWARE.LOG2 Locked file. Not scanned. is OK.
C:\Windows\System32\config\SYSTEM Locked file. Not scanned. is OK.
C:\Windows\System32\config\SYSTEM.LOG1 Locked file. Not scanned. is OK.
C:\Windows\System32\config\SYSTEM.LOG2 Locked file. Not scanned. is OK.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\ Locked file. Not scanned. is OK.
C:\Windows\System32\LogFiles\WMI\RtBackup\ Locked file. Not scanned. is OK.
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat Locked file. Not scanned. is OK.
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat.LOG1 Locked file. Not scanned. is OK.
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat.LOG2 Locked file. Not scanned. is OK.
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{fa148919-8e95-11e4-825c-c71bbcbd2323}.TM.blf Locked file. Not scanned. is OK.
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{fa148919-8e95-11e4-825c-c71bbcbd2323}.TMContainer00000000000000000001.regtrans-ms Locked file. Not scanned. is OK.
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{fa148919-8e95-11e4-825c-c71bbcbd2323}.TMContainer00000000000000000002.regtrans-ms Locked file. Not scanned. is OK.
------------------------------------------------------------
Test started: 27.6.2015 6:36:07
Duration of test: 31 minute(s) 10 second(s)
------------------------------------------------------------
Objects scanned : 225439
Found infections : 132
Found high severity : 0
Found med severity : 0
Found info severity : 132
Fixed high severity : 0
Fixed med severity : 0
Fixed info severity : 0
------------------------------------------------------------
No I haven't, I"ll try it and report back.
Thanks,
Joshua, Vosteran… Have you tried Malwarebytes Free?.
AVG Guru
Ok, so I downloaded malwarebytes and scanned. I've posted the below report from the scan and removal. It only found 30 files where avg found over 100. Should I still be concerned?
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 6/27/2015
Scan Time: 9:10:56 AM
Logfile:
Administrator: Yes
Version: 2.01.6.1022
Malware Database: v2015.06.27.02
Rootkit Database: v2015.06.26.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 8.1
CPU: x64
File System: NTFS
User: Joshua
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 349991
Time Elapsed: 24 min, 13 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 14
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, Quarantined, [565811ae1a7062d4b5fde3af08fd03fd],
PUP.Optional.SuperOptimizer.C, HKLM\SOFTWARE\WOW6432NODE{1146AC44-2F03-4431-B4FD-889BC837521F}, Quarantined, [e8c62c938dfde254baf3cbc9e61fe51b],
PUP.Optional.SuperOptimizer.C, HKLM\SOFTWARE\WOW6432NODE{6791A2F3-FC80-475C-A002-C014AF797E9C}, Quarantined, [3d713788ee9cf640d3db7a1a11f48f71],
PUP.Optional.Vosteran.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\MEDIAPLAYER\SHIMINCLUSIONLIST\vosteran.exe, Quarantined, [a30b259a7c0ee6500e0c3ac9c341a25e],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{d164f2af}, Quarantined, [00aec3fc8ffb2511ce35efa291743cc4],
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE, Quarantined, [317dc4fb7713999dddd54d4506ffe61a],
PUP.Optional.FasterLight.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util Faster Light, Quarantined, [a6084f70b0da84b2fc93f9148f75de22],
PUP.Optional.SuperOptimizer.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW{1146AC44-2F03-4431-B4FD-889BC837521F}, Quarantined, [b8f6d0efdcae39fdd3d91a7a689df709],
PUP.Optional.InstallCore.C, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\InstallCore, Quarantined, [05a9c2fd56347db91a8e33619c690bf5],
PUP.Optional.Vosteran.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\Vosteran, Quarantined, [b1fd08b7c2c892a49b600afe857fd52b],
PUP.Optional.Vosteran.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\Vosteran Browser, Quarantined, [79357847addd1620cd2e897f4db7ea16],
PUP.Optional.SuperOptimizer.C, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\APPDATALOW{1146AC44-2F03-4431-B4FD-889BC837521F}, Quarantined, [228c2897d7b3a3933577b8dc36cfa15f],
PUP.Optional.Vosteran.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [4767edd2771393a3c710ea9e778edb25],
PUP.Optional.OptimizerPro.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\OPTIMIZER PRO, Quarantined, [6945c8f705859a9c75e1e3affa0be21e],
Registry Values: 5
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, Quarantined, [565811ae1a7062d4b5fde3af08fd03fd]
PUP.Optional.Vosteran.C, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\WSE_Vosteran\, Quarantined, [e3cb922dc4c671c5588d6791f21111ef]
PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, Quarantined, [317dc4fb7713999dddd54d4506ffe61a]
PUP.Optional.Vosteran.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Vosteran, Quarantined, [4767edd2771393a3c710ea9e778edb25]
PUP.Optional.OptimizerPro.A, HKU\S-1-5-21-1796656653-915960019-316723554-1001\SOFTWARE\OPTIMIZER PRO|AdsBuyNowURL, http://www.safeshopgate.com/r?s=121000600&g=C56A7C8D-CA42-4BA1-EF84-B553D789EC27, Quarantined, [6945c8f705859a9c75e1e3affa0be21e]
Registry Data: 0
(No malicious items detected)
Folders: 6
PUP.Optional.UpdateProc.A, C:\Users\Joshua\AppData\Roaming\UpdaterEX\UpdateProc, Quarantined, [5658962929611e1837d46a8d05fe25db],
PUP.Optional.UpdateProc.A, C:\Users\Joshua\AppData\Roaming\UpdaterEX, Quarantined, [5658962929611e1837d46a8d05fe25db],
PUP.Optional.OptimizerPro.A, C:\Users\Joshua\Documents\Optimizer Pro, Quarantined, [f8b6457a088248ee5301eba700056997],
Rogue.Multiple, C:\ProgramData\1078601655, Quarantined, [baf4902f17730e28fa6fa21142c19769],
PUP.Optional.UltraCoupon.A, C:\ProgramData\UltraCoupon, Quarantined, [c4ea605fabdf39fddfadfee8af54f50b],
PUP.Optional.WorldWideWebCoupon.A, C:\ProgramData\WorldWideWebCoupon, Quarantined, [1896625d7e0c60d65a83816fb053bb45],
Files: 5
PUP.Optional.MultiPlug.Uns, C:\ProgramData\UltraCoupon\UltraCoupon.exe, Quarantined, [f7b707b84a4056e0df5fadba9073f709],
PUP.Optional.MultiPlug.Uns, C:\ProgramData\WorldWideWebCoupon\WorldWideWebCoupon.exe, Quarantined, [6e40e6d99bef71c5d866db8c976ccf31],
PUP.Optional.UpdateProc.A, C:\Users\Joshua\AppData\Roaming\UpdaterEX\UpdateProc\prod.dat, Quarantined, [5658962929611e1837d46a8d05fe25db],
PUP.Optional.UpdateProc.A, C:\Users\Joshua\AppData\Roaming\UpdaterEX\UpdateProc\config.dat, Quarantined, [5658962929611e1837d46a8d05fe25db],
PUP.Optional.OptimizerPro.A, C:\Users\Joshua\Documents\Optimizer Pro\CookiesException.txt, Quarantined, [f8b6457a088248ee5301eba700056997],
Physical Sectors: 0
(No malicious items detected)
(end)
Hello Joshua. Thank you for posting the logs. I would like to inform you that all the files that AVG said they can not be scanned are locked files. Locked files are the files in use by other process (operating system) and mostly critical in use. As they are still locked by system, they cannot be infected. You can ignore these detection. Thank you.