Full Path: e:\autorun.

inf ____________________________ ____________________________ On computers as of Not Available Last Used 8/9/2012 at 4:34:42 PM Startup Item No Launched No ____________________________ ____________________________ Unknown Number of users in the Norton Community that have used this file: Unknown ____________________________ Unknown This file release is currently not known. ____________________________ High This file risk is high. ____________________________ Threat Details Threat type: Virus. Programs that infect other programs, files, or areas of a co mputer by inserting themselves or attaching themselves to that medium. ____________________________ ____________________________ File Actions File: e:\autorun.inf Removed File: e:\office_2010_plus_ful\office_2010_plus_ful .exe Removed File: e:\office_2010_plus_ful\make windows original.exe Removed ____________________________ Registry Actions Registry change: HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\E xplorer\Advanced\->Hidden:1 Restart Required Registry change: HKEY_USERS\S-1-5-21-2274634172-3921487260-2383258728-1000\Softw are\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->Hidden:1 Restart Required Registry change: HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\E xplorer\Advanced\->Hidden:1 Restart Required Registry change: HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\E xplorer\Advanced\->HideFileExt:0 Restart Required Registry change: HKEY_USERS\S-1-5-21-2274634172-3921487260-2383258728-1000\Softw are\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->HideFileExt:0 Restart Required Registry change: HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\E xplorer\Advanced\->HideFileExt:0 Restart Required Registry change: HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\E xplorer\Advanced\->ShowSuperHidden:1 Restart Required Registry change: HKEY_USERS\S-1-5-21-2274634172-3921487260-2383258728-1000\Softw are\Microsoft\Windows\CurrentVersion\Explorer\Advanced\->ShowSuperHidden:1 Restart Required Registry change: HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\E xplorer\Advanced\->ShowSuperHidden:1 Restart Required

Registry change: HKEY_CLASSES_ROOT\CLSID\{79806449-AB35-42EC-9BE9-B390209CE514} Restart Required Registry change: HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\TazebamaHo ok Restart Required Registry change: HKEY_CLASSES_ROOT\Interface\{6A198FC3-51AA-4403-B281-168F86D905 3A} Restart Required Registry change: HKEY_CLASSES_ROOT\Tazebama.TazebamaHook.1 Restart Required Registry change: HKEY_CLASSES_ROOT\Tazebama.TazebamaHook Restart Required Registry change: HKEY_CLASSES_ROOT\TypeLib\{7B154753-C2FF-45C9-974E-98E4D3914D9C } Restart Required Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Sh ell Extensions\Approved\->{79806449-AB35-42EC-9BE9-B390209CE514} Restart Required Registry change: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\E xplorer\Advanced\->Hidden:1 Restart Required Registry change: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\E xplorer\Advanced\->HideFileExt:0 Restart Required Registry change: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\E xplorer\Advanced\->ShowSuperHidden:1 Restart Required ____________________________ File Thumbprint - SHA: 7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e ____________________________ File Thumbprint - MD5: 163e20cbccefcdd42f46e43a94173c46 ____________________________